MCP Security Goes Architectural: Prompts Don't Protect

Two papers from the past week mark an inflection point in MCP security thinking.

The Problem: Prompts Are Not Security

Rohith Uppala’s paper “Prompts Don’t Protect” demonstrates a critical finding: when unauthorized tools are visible in an agent’s context window, LLMs will select them in adversarial scenarios — even when explicitly instructed otherwise in the system prompt. The prompt is a suggestion, not a security boundary.

The Solution: Protocol-Layer Enforcement

The proposed MCP Proxy sits between the agent and MCP servers, enforcing access control before tool calls reach the LLM. This is an architectural shift — security moves from the prompt layer (soft, unreliable) to the protocol layer (hard, enforceable).

Enterprise Adoption

A separate paper from the ADR team describes the first large-scale, production-proven enterprise framework for securing AI agents operating through MCP. They identify three challenges: limited observability (existing EDR tools don’t understand MCP), protocol-level attack surfaces, and the need for runtime detection rather than static analysis.

What This Means for agentk.it Users

Every MCP server indexed in this directory is a potential tool an agent can invoke. Understanding that prompt-based restrictions are insufficient helps you evaluate which MCP servers to trust and how to deploy them securely.

Source: arXiv:2605.18414 (Prompts Don’t Protect) and arXiv:2605.17380 (ADR System)