MCP and AI agent risk: what changes when AI can act

The Model Context Protocol is an open protocol that lets an AI application connect to external tools and data sources through MCP servers. A coding agent can use an MCP server to read a repository, query a ticket system or run a command. The agent decides which tool to call and with what arguments; the MCP server carries it out.

Three stand out. Prompt injection becomes action: text hidden in a web page, a document or a tool result can instruct the agent to call a tool the user never intended. Permissions pile up: each MCP server holds credentials, and an agent with many servers holds many keys. Data moves without a person typing it: an agent can read a file through one tool and send it out through another.

They work on the agent's actions. An inventory lists agents, MCP servers and the tools they expose. Policy decides which servers and tools are allowed. Inline inspection reads tool calls and their arguments and can block a call before it runs. Logging ties each action to the agent and the person behind it.

Four of the six vendors here describe MCP-specific controls on the pages we read. Cato states it maps agents, MCP servers and skills and inspects agent tool calls; Zscaler states MCP and A2A brokers; Fortinet states FortiAIGate catches prompt injection and data leaks in MCP tool traffic; Netskope describes an Agentic Broker that decodes MCP traffic. Cisco and Palo Alto Networks describe agent controls, but MCP is not mentioned on the pages we read.

Source: Cato Networks: AI security · Read 7 Oct 2026

Find out which agents and MCP servers are already in use, starting with developers. Agree an allowed list of servers. Then put the riskiest actions, such as shell commands, writes to production and outbound sends, behind a control that can block or ask before they run.

With a chat assistant, the worst case is usually a leak: someone pastes data that should not leave. With an agent, the worst case includes an action: a deleted branch, a changed record, a message sent to the wrong place. The agent may also act many times a minute, faster than a person can review. That changes what a control must do. It has to decide on each action before it runs, using who the agent acts for, what it has already read and what the tool would do, and it has to log the decision so someone can trace it later. A policy written for chat tools rarely covers this, which is why the checklist on this site has a separate section for agents and MCP servers.