MCP risks: 6 security issues and how to reduce them

MCP, short for Model Context Protocol, helps AI tools move beyond answering questions and start working with the files, apps and systems your team already uses. It can make AI far more useful, but it also creates new routes to sensitive content and potentially damaging actions.

This means understanding each connection, limiting what it can access, and adding checks around the actions it can take. As more teams experiment with agentic AI, strong security is what turns a promising pilot into a workflow your business can trust and scale.

Start with three simple questions when assessing any MCP connection: 

• What can it see? 
• What can it do? 
• Where can it share the result?

Here we’ll look at the biggest MCP security risks and explain how Dropbox helps keep access to Dropbox content tied to existing permissions and admin controls. Explore Dropbox AI integrations to securely link AI with your most important files—choose a Dropbox plan to get started.

What is MCP and where can risk enter the workflow?

MCP is an open protocol that gives an AI application a standard way to connect with external data and tools. An MCP server sits between the AI client and the connected service, making permitted data and supported actions available when the tool requests them.

MCP does not replace the connected service’s security controls, but it does create a route for the AI client to request data and take action. Security therefore depends on the full chain, including the:

• client
• Server
• Identity
• token
• Scope
• Permissions
• Available tools and source content

A read-only connection to one folder is very different from one that can edit files, create links or run commands, so each setup needs to be reviewed according to what it can reach and do.

What are the main MCP security issues?

The MCP specification calls for explicit consent, clear authorisation, access controls, and care around tools that can execute code or change data. The most common risks include:

1. Excessive permissions and context over-sharing

Broad scopes may expose more content than the task requires. For example, an assistant might need one project brief but receive access to a whole client folder or permission to edit files. This over-sharing is a potential security risk.

To mitigate this, start with narrow, read-only access where possible. Add privileges only when a specific action requires them. Most MCP guidance recommends progressive, least-privilege scopes, instead of broad access up front.

2. Untrusted or compromised MCP servers

An unknown publisher, altered dependency, abandoned package or unapproved ‘shadow’ server can introduce risk. A server is only as trustworthy as the people and processes behind it, which makes it a key component of security.

Confirm who operates the server, how it is maintained, the permissions it requests, and how updates arrive. Remove connections that no longer have an owner. If you cannot verify who is responsible for it, do not let it remain connected to your content or systems.

3. Prompt injection and tool poisoning

Malicious instructions can hide in files, web pages, tool descriptions, or altered tool definitions. They may steer the AI client towards an action the user did not intend, which makes security tricky for sensitive data.

As a best practice against this, treat retrieved content and tool metadata as untrusted. Validate tool definitions, restrict available tools, and never let a document authorise an action.

4. Unsafe or destructive actions

MCP tools may move or delete files, create shared links, change records, or run commands. A mistaken request or manipulated prompt can therefore have a real effect.

Separate retrieval from higher-impact actions to protect your data. Limit approved operations, validate parameters, sandbox local tools, and require confirmation for deletion, code execution, permission changes or external sharing.

5. Weak approval controls

A vague prompt such as ‘Do you want to continue?’ does not explain what will happen. Repeated confirmations may also become routine clicks that users approve without checking.

Using a specific prompt, such as ‘Move “Q4 forecast.xlsx” from the Working folder to Approved and replace the existing version’, means that the user can immediately see the file, action, destination and consequence.

It is important to show the exact file or system, action, destination, and likely effect. Consider requiring stronger approval for actions with wider consequences, such as deleting folders, replacing files, changing permissions, or sharing content externally, rather than treating every operation the same.

6. Token, session, and audit gaps

Long-lived credentials, passing tokens between services without validation, poor session separation and incomplete logs make MCP misuse harder to prevent and investigate.

Use approved OAuth flows, tokens limited to the intended server and required scopes, secure storage, and clear expiration. Log tool calls, access changes, sharing actions, and failed authorisation attempts. Ensure that admins are also able to disconnect the integration and remove access.

MCP server security best practices: a pre-connection checklist

With the above security risks in mind, use this checklist before approving a server:

• Verify the client and server—confirm the publisher, owner, hosting model and update process
• Map what it can see—list the accounts, Folders, files, and systems within scope
• Review what it can do—separate retrieval from editing, deletion, sharing and commands
• Start with the least access possible—grant only the scopes required for the current workflow
• Require specific approval—show the object, action, destination, and consequence
• Log and review activity—capture enough detail to investigate unexpected behaviour
• Test removal—confirm that you can disconnect the server and invalidate access

If a server cannot pass every check, pause the connection until the risk is known and addressed.

How Dropbox keeps AI access tied to trusted content

When it comes to maintaining MCP security, a useful principle is to keep the rules attached to the content.

With the Dropbox remote MCP server, you can connect Dropbox to supported MCP clients, including:

• ChatGPT Web
• ChatGPT Codex
• Cursor
• Claude Web
• Claude Code

The connection uses Dropbox OAuth and supports search, file organisation, shared link creation, file requests, and version recovery.

Separately, Dropbox for Claude includes the Dropbox connector for claude.ai and Claude desktop—as well as the Dropbox plugin for Claude Cowork and Claude Code. These maintain existing permissions and admin controls. That means you can find, organise or share Dropbox content and save Claude-generated text to Dropbox. Features varying slightly between Claude tools.

Your MCP security review should still cover the client, server operator, requested scopes, provider settings, and content sensitivity. This keeps AI-assisted work connected to trusted source content and established collaboration controls.

Keep control of what AI can see, do, and share

To mitigate MCP security risks, choose trusted servers, limit access, make approvals meaningful and keep source permissions attached to the work. 

Those controls give your team room to use the AI tools that suit the task—while keeping confidential content under control. Explore Dropbox AI integrations and use AI safely with your files.