MCP Security Hub

Subscribe Advertise

MCP Security Tools & Best Practices

Secure your MCP deployments before they become an attack path. Independent tools, checklists, and field notes for security teams and AI platform engineers.

Browse security tools Read the checklist

Updated July 202625+ tools reviewedBased on OWASP, NSA, and CIS guidanceIndependent — no vendor owns this page

Why MCP security is different from API security

Traditional API security assumes predictable request paths and fixed permissions. MCP flips that model: an LLM decides at runtime which tool to call, with what arguments, and how to interpret the result.

That means standard WAFs, API gateways, and static policy engines often miss the risks unique to agentic tool use.

Common MCP risks

Risk Tool poisoning: a malicious MCP server returns instructions that hijack the agent.
Risk Confused deputy: one application abuses permissions granted to another.
Risk Overly broad scopes: an MCP server asks for more access than it needs.
Risk Plaintext credentials: tokens stored in local config files or clipboard history.

A field guide built for security teams

MCP Gateways

Control which servers your agents can reach and what they can do.

Monitoring & Observability

See every tool call, anomaly, and policy violation.

Testing & Audit

Scan configurations and simulate attacks before attackers do.

Tools we are tracking now

Short reviews with what each tool does, where it fits, and what to watch out for.

A

Aembit

Gateway

Identity-based access control for AI agents and MCP servers.

EnterpriseZero TrustOAuth

EnterpriseVisit website

O

Obot

Gateway

Open-source MCP gateway with policy enforcement and audit logging.

Open SourceSelf-hostedPolicy

Free / Enterprise supportVisit website

T

TrueFoundry MCP Gateway

Gateway

Enterprise gateway for AI agent tool access with policy controls.

EnterpriseSaaSGovernance

EnterpriseVisit website

M

MCP Manager

Gateway

Commercial MCP gateway and management layer for teams.

SaaSTeamManagement

Team / EnterpriseVisit website

P

Promptfoo

Guardrails

Open-source framework for testing LLM vulnerabilities and agent tool abuse.

Open SourceRed TeamCI/CD

Free / EnterpriseVisit website

E

Elastic

Monitoring

SIEM and observability platform for agent tool call logging and anomaly detection.

EnterpriseSIEMObservability

EnterpriseVisit website

Practical guides

The MCP Security Checklist

A practical checklist for securing Model Context Protocol deployments.

OWASP MCP Top 10 Explained

What security risks are specific to MCP deployments and how to defend against them.

What Is MCP Tool Poisoning?

How attackers can hijack agents through malicious MCP servers and what to detect.