🚀 Submit a Challenge — SecDim AppSec Village CTF at DEF CON 34 and Win a ROG Xbox Ally

Sign InContact sales
Sign InContact sales

MCP Security for Developers

5h 30mIntermediateAI

The Model Context Protocol gives AI agents access to tools, files, databases, and APIs -- and gives attackers a new way in unlike any vulnerability before. In 2025-2026, over 40 CVEs were filed against MCP implementations, malicious packages appeared on registries, and the NSA published its first MCP security guidance. This course teaches developers who build or consume MCP servers to identify and defend against each attack class, from tool poisoning to supply chain compromise, using documented incidents and proof-of-concept exploits.

Begin course

Topics

  1. Introduction

    Lesson5m

    Overview of the course, learning objectives, audience, prerequisites, and the full syllabus.

  2. MCP and the Tool Trust Boundary

    Video20m

    What MCP is, how tools, resources, and prompts work at the protocol level, and why connecting an MCP server is a trust decision the host makes on behalf of the user. Traces a tool call end-to-end and identifies the three points where untrusted input enters the model context.

  3. Tool Poisoning

    Video25m

    How malicious instructions hidden in tool descriptions, parameter names, and error messages steer the model into executing attacker-chosen actions. Covers the full attack surface including cross-server poisoning and the CyberArk Poison Everywhere research.

  4. MCP Tool Poisoning Lab

    Lab30m

    Exploit and fix tool poisoning in a hands-on lab

  5. Rug Pull Attacks

    Video20m

    How an MCP server that passes initial review changes tool definitions or behaviour after the user has granted trust. Covers definition rug pulls, behaviour rug pulls, and why approval-time inspection is insufficient.

  6. Tool Shadowing and Naming Collisions

    Lesson25m

    How a malicious server influences the model use of tools on other servers without being invoked itself. Covers description-based shadowing, name collision attacks, and MCP Preference Manipulation Attacks (MPMA).

  7. Indirect Prompt Injection via Tool Responses

    Video25m

    How attacker-controlled content in a tool return value steers the model into unintended actions. Covers the toxic triad that makes indirect injection exploitable and the privilege separation controls that break the attack chain.

  8. MCP Indirect Prompt Injection Lab

    Lab30m

    In this hands-on lab, you identify, exploit indirect prompt injection and fix toxic triad in a vulnerable MCP server

  9. Command Injection, Path Traversal, and SSRF

    Video25m

    Classical web vulnerabilities in MCP server implementations and why they are amplified when the server runs with developer privileges. Covers real CVEs in MCP reference servers with parameterised execution, path canonicalisation, and URL validation fixes.

  10. MCP Exploit Lab

    Lab30m

    In this hands-on lab, exploit command injection, path traversal and SSRF via LLM prompts again an insecure MCP server

  11. MCP Supply Chain Attacks

    Video20m

    The supply chain risks of installing MCP servers from public registries and package managers. Covers trojanised clones, malicious registry packages, hosting platform compromises, and dependency-level attacks with real 2025-2026 incidents.

  12. MCP Authentication and Credential Management

    Lesson25m

    OAuth 2.1 with PKCE for remote MCP servers, why API keys are insufficient, token validation including audience and scope checks, Protected Resource Metadata, Resource Indicators, and credential management practices that prevent the OWASP MCP number one risk.

  13. Building a Secure MCP Server

    Lesson20m

    A secure-by-default checklist covering input validation, output sanitisation, authentication, least privilege, tool integrity, logging, and supply chain controls -- mapped to the OWASP MCP Top 10 and the NSA May 2026 guidance.

  14. MCP Security Challenges

    Challenge30m

    Complete these MCP security challenge to put your learnings into practice.