Europe 2026
Your Insecure MCP Server Won't Survive Production — Tun Shwe, Lenses
Overview
This talk addresses the critical security and design considerations for Multi-modal Communication Protocol (MCP) servers intended for production environments. It argues that insecure or poorly designed MCP servers are vulnerable to exploitation by agentic AI systems. The presentation emphasizes that robust security and effective design are intertwined, advocating for a product engineering mindset when building interfaces for AI agents.
Who should watch
- AI Engineers
- Product Managers
- Builders of agentic AI systems
- Those responsible for securing AI infrastructure
- Anyone deploying MCP servers in production
Key takeaways
- Agentic AI systems interact with MCP servers differently than humans, enumerating tools and iterating requests frequently, which expands the attack surface for issues like tool poisoning and data leakage.
- Security vulnerabilities in MCP servers, such as context injection and oversharing of sensitive data, are often a direct result of poor design choices.
- Shrinking the attack surface by design is paramount; consolidate fine-grained operations into coarse-grained tools that produce specific outcomes, reducing the number of access points.
- Constrain inputs at the schema level using primitives or libraries like Pydantic to prevent command injection flaws.
- Treat tool documentation as a defensive layer; clear, unambiguous instructions can crowd out space for malicious instructions embedded by attackers.
- Return only the necessary data to the agent to prevent sensitive information from being exposed within the agent's context window and becoming susceptible to exfiltration.
- Minimize the blast radius by scoping permissions at the tool and resource level, not just the session level, and removing unnecessary tools.
- Transitioning from local, standard I/O MCP setups to production-ready HTTP transport requires implementing robust security measures like OAuth, token management, and TLS, as standard I/O is not scalable or secure for concurrent connections.
Notable quotes
*Agents deserve their own interface that is optimized for their use cases.*
*A badly designed MCP server is also a badly secured one.*
*Every tool you expose is a door. Don't give the agent access to delete users when all it needs is to check an order.*
Unofficial community note. Prefer the recording for nuance.