NSA's MCP guidance: hardening agentic AI before you deploy

What is this?

On 20 May 2026, the National Security Agency’s Artificial Intelligence Security Center (AISC) published a Cybersecurity Information Sheet titled Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation. It is a 17-page design document, not a vulnerability advisory: it maps the systemic risks of building agent workflows on MCP and offers practical recommendations for organizations deploying it in high-stakes or production environments.

The framing is the interesting part. The NSA argues that MCP, like early web protocols, shipped with a flexible and underspecified design — good for adoption, ambiguous for safe implementation. Classic controls such as authentication, authorization and input validation remain necessary, the agency says, but they do not adequately address the novel risks that agentic systems introduce: dynamic tool invocation, implicit trust relationships, and shared context across services. This is one of the first pieces of national-agency guidance to treat MCP specifically as its own security domain rather than a generic integration layer.

What the guidance flags

The document does not publish an attack. It enumerates classes of weakness that adopters keep rediscovering the hard way. Three themes recur.

First, trust boundaries dissolve. MCP reverses the familiar pattern in which a client queries a server; here, tool servers can effectively drive actions inside the agent’s context, and an agent tends to treat tool output as trusted context rather than untrusted input. Second, serialization and message handling create room for hidden instructions and malformed data to cross between components without adequate screening. Third, agent misuse and over-automation: an AI system wired to MCP can decide on its own to call new tools or take new actions, so a single misaligned assumption early in the chain can propagate.

The NSA’s central metaphor is that these are not endpoint bugs to be patched in isolation. Securing an MCP deployment means treating the whole agentic environment as a continuum, because “subtle inconsistencies at any stage can propagate and compound into exploitable conditions.” No payload is needed to understand the lesson — the risk lives in the architecture.

Why it matters

MCP adoption has outpaced its security model. The guidance notes real-world use across business, finance, legal and software-development products, including sensitive tasks like querying personally identifiable information. That is precisely the setting where implicit trust and unlogged tool calls turn a convenience feature into an incident.

For defenders, the value of the document is that it is authoritative and vendor-neutral. It gives security teams a reference they can cite when pushing back on “just connect the MCP server and ship it,” and it aligns with the direction of other 2026 frameworks. It is guidance, not a mandate, and it will age as the protocol evolves — but it establishes a shared vocabulary for the risks that per-endpoint hardening keeps missing.

Defenses

The CSI’s recommendations translate cleanly into engineering practice. The through-line is least privilege plus provenance.

• Do not rely on MCP’s own defaults. The NSA is explicit that built-in suggestions are insufficient; add deliberate safeguards tailored to your environment, and pull tools only from well-maintained, reputable providers and repositories.
• Validate every request against a policy. Each tool and model invocation should be checked for shape, expected limits, and harmful content before it executes — treat tool output as untrusted input, not authoritative context.
• Log tool and model calls with full context. Record the tool requested, the exact parameters, the identities involved, and the result, and feed those logs into existing security monitoring so a later investigation can reconstruct what happened.
• Segment tools by data classification. Group tools into zones by sensitivity, and explicitly control and isolate those that touch sensitive data instead of exposing one flat tool surface.
• Keep sensitive processing local. When handling private or regulated data, run MCP tools locally rather than through external services, and pin resource URLs and access methods tightly.
• Constrain outbound paths. Place a filtering egress proxy or enterprise DLP in front of external MCP connections to reduce unintended data leakage from the agent context.

Status

Aspect	Detail
Publisher	NSA Artificial Intelligence Security Center (AISC)
Document	Cybersecurity Information Sheet, U/OO/6030316-26, Ver. 1.0
Published	20 May 2026 (17 pages)
Type	Design guidance — not a CVE or vulnerability advisory
Scope	MCP in high-stakes / production agentic deployments

The takeaway is a shift in posture rather than a new exploit: agentic AI built on MCP inherits risks that endpoint-level fixes cannot close, and the NSA’s contribution is to name those risks and give adopters a concrete, provenance-first checklist to apply before, not after, deployment.