Supply chain security for MCP servers

MCP servers are external dependencies that provide tools to your AI agent. Each MCP server you connect is a supply chain link. If a server is compromised, your agent inherits the compromise. Supply chain security for MCP servers means verifying what you connect to, monitoring for changes, and isolating the impact of a compromise.

The supply chain risk

When you connect an MCP server, you trust it to:

• Expose only the tools it claims to expose
• Provide accurate tool descriptions
• Return honest results
• Not inject instructions into responses
• Not change behavior without notice

Any of these assumptions can be violated by a compromised server.

Verification

Before connecting an MCP server:

Source verification: Is the server from a known, trusted publisher? Check the package registry, repository, and maintainer reputation.

Code review: For critical tools, review the server's source code. Check what data it accesses, what network connections it makes, and what the tools actually do.

Signature verification: If the publisher signs releases, verify the signature before deploying.

Lock tool descriptions

After initial verification, snapshot the tool descriptions:

# expected-tools.yaml
servers:
  filesystem:
    version: "1.2.0"
    tools:
      file_read:
        description_hash: "sha256:abc123..."
      file_write:
        description_hash: "sha256:def456..."

On each startup, verify that the descriptions match. If they change, block the server and investigate.

Isolate MCP servers

Run each MCP server in its own isolated environment:

• Separate containers or processes
• Individual network policies
• Distinct credentials and permissions
• Independent monitoring

If one server is compromised, the isolation prevents the compromise from reaching other servers or the host system.

Monitor for changes

Watch for behavioral changes in MCP servers:

• New tools appearing or existing tools disappearing
• Tool descriptions changing
• Response patterns changing
• New network connections from the server process
• Increased resource usage

Version pinning

Pin MCP server versions and update deliberately:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-filesystem@1.2.0"]
    }
  }
}

Do not use latest tags in production. Test updates in staging before deploying to production.

MCP gateway as a chokepoint

Route all MCP traffic through the Authensor MCP gateway. The gateway provides a single enforcement point where you can:

• Validate tool descriptions against allowlists
• Scan tool responses for injection
• Log all tool interactions
• Block unexpected tools or changed descriptions

The gateway cannot make an untrusted server trustworthy, but it can limit the damage a compromised server can cause.

Response plan

If you discover a compromised MCP server:

1. Disconnect the server immediately
2. Kill all agent sessions that used the server
3. Review receipts for actions taken through the server's tools
4. Assess what data the server could have accessed
5. Notify affected parties if data was compromised
6. Replace the server with a verified alternative