MCP Is Becoming the Trust Layer for AI Agents. It Wasn't Built to Be One

01 The Protocol Layer Nobody Planned to Secure

The Model Context Protocol began life in November 2024 as a plumbing spec: an open standard, built on JSON-RPC 2.0, that lets an AI application — the host — connect to external tools and data through servers that advertise their capabilities. Its own security documentation said the quiet part early: servers are untrusted third parties, hosts must obtain explicit user consent, and tool descriptions should be treated as untrusted input. The protocol standardized the conversation between agents and the world. It deliberately did not standardize the policing of it.

Two years later, MCP is the connective tissue of the agent ecosystem, which makes that deliberate gap the most consequential design decision in applied AI. Every serious agent framework speaks it, and the amount of money and data moving at the end of an MCP tool call grows monthly. Trust, meanwhile, remains whatever each host application happens to implement — which is another way of saying it is unevenly distributed and unequally audited.

02 Three Companies, One Standard, Five Months

The adoption curve compressed the usual standardization timeline brutally. Anthropic open-sourced MCP in late November 2024. OpenAI adopted it in March 2025, wiring it into its Agents SDK — the first time the two labs had converged on a significant piece of AI infrastructure. Google DeepMind followed in April 2025. Five months after launch, the protocol had the three largest AI platforms speaking one interface.

Adoption at that speed has a cost: deployment outran hardening. Enterprise integrations, consumer agents, and hobbyist servers all spun up on the same spec in the same quarters, and the security research that usually shapes a protocol over years instead raced to keep up with installs. The result is a standard whose most-cited security documents are incident write-ups and attacker playbooks rather than certification regimes.

03 Where the Trust Boundary Actually Sits

MCP's architecture concentrates decisions in the host. The host aggregates servers, presents tools to the model, mediates consent, holds credentials, and executes the calls. The specification is candid that this is where safety lives: sampling and tool use require explicit human approval, and the human must see what they are approving in enough detail to judge it. In practice, the quality of that judgment depends on how well the host renders a server's capabilities — and those capabilities are self-described text.

That last clause carries the whole problem. A tool description is marketing written by a stranger, and the model reads it as ground truth. If the description is honest, the user can make an informed choice; if it is not, every layer above it — the model that selects the tool, the user who confirms it, the host that executes it — is operating on attacker-controlled metadata. The protocol verifies the shape of a tool call. It cannot verify the honesty of the label on the tool.

04 Tool Poisoning and the Confused Deputy

Security researchers demonstrated the attack class within months of the adoption wave. Invariant Labs documented tool-poisoning attacks in April 2025: a malicious instruction hidden inside a tool's description — invisible in the interface, legible to the model — instructing the agent to leak connected context or manipulate other tool calls. The related confused-deputy pattern lets an innocuous server piggyback on the elevated permissions of another, because what separates intentions is the host and the model, not the protocol.

The deeper lesson generalizes past MCP. Every protocol that lets software advertise itself in natural language to another piece of software inherits prompt injection as an authorization problem. Prompt injection stopped being a chat-abuse nuisance the moment tool descriptions became executable trust decisions. The industry has mature practice for parsing untrusted input; it has almost none for parsing untrusted intent.

05 The Credential Problem

Beneath the description-injection layer sits the credential layer, and it is where the blast radius lives. In an MCP deployment, OAuth tokens and API keys are held by hosts and passed through servers, which turns every MCP server into a credential broker — and every compromised server, host, or token store into a pivot point across every connected system at once. A prompt-injection bug that leaks data is bad; a prompt-injection bug that leaks a live token set is an intrusion.

The gap the chart sketches is a maturity gap, not a spec gap. The specification tells hosts to implement consent; it cannot make downstream APIs issue least-privilege tokens, and most current tooling connects with whatever scope the developer copied from a quickstart. Until server-side validation and downstream authorization tighten, the weakest checkpoint in the chain defines the security of the whole deployment — the oldest rule in security, now applied to agent plumbing.

06 Designing for Least Privilege in an Agent World

The mitigations are known and mostly unglamorous. Scope tokens to the specific action a server performs, and expire them fast. Allowlist servers and tools per deployment rather than installing from registries wholesale. Render tool descriptions with their provenance, and diff them between versions — a changed description is a signal, not a footnote. Put human confirmation on the irreversible actions: money movement, deletion, external sends. Log every tool call with its arguments so incidents can be reconstructed at all.

What makes this moment difficult is that agent workflows erase the visual cue that taught users caution. A browser shows a URL; a shell shows a command. An agent shows a sentence, and the tool it invoked is a paragraph of metadata the user never reads. Restoring that visibility — making machine-to-machine trust legible to the person who owns the consequences — is a user-experience problem as much as a protocol one, and it is unsolved.

07 What a Real Trust Layer Would Require

If MCP is to carry the trust load it has inherited, the missing pieces are concrete. Signed tool manifests with attested provenance, so descriptions have authors accountable for them. Standardized permission semantics, so a user grants capabilities once and every host enforces them identically. Scoped, revocable credential mediation that does not depend on the server's good behavior. None of these require rethinking the wire protocol; they require treating the trust surface as a first-class part of the standard rather than a set of warnings.

Until then, the honest posture for 2026 is conditional trust with human gates at the points of no return. The video below explains why the protocol matters and how quickly it won; the audit above is the bill for winning that fast. MCP succeeded as interoperability. Whether it succeeds as infrastructure depends on treating its security documentation not as advice, but as the actual specification of what hosts owe their users.