Model Context Protocol (MCP) is an open standard (released by Anthropic in late 2024) that lets AI agents discover and connect to external tools dynamically — at runtime, from any source, without the developer hardcoding them in advance.
Instead of an agent having 5 tools built in, it can now connect to any MCP server and gain access to hundreds of tools — file systems, databases, APIs, calendars, browsers — dynamically.
Before MCP: a developer chose which tools to give an agent at build time. The set was fixed, auditable, and small. A security review could enumerate every tool and its permissions.
After MCP: an agent discovers tools at runtime from external registries. The tool set is dynamic, can change between sessions, and the tools come from third parties. Tool descriptor poisoning — where an attacker corrupts the metadata of a legitimate tool — is now possible at scale.
In 2025, Invariant Labs demonstrated a prompt injection in GitHub's MCP server where a malicious public repository hid commands in its tool metadata. When the assistant invoked the tool, it exfiltrated private repository data — without the user's knowledge. The tool was legitimate. The misuse was in the metadata.
In an agentic world, every tool your agent can reach — including tools it discovers dynamically — is part of your attack surface. If you haven't audited it, you haven't secured it.