MCP server security: should it be exposed online?
MCP's headline risks — prompt injection, tool poisoning, malicious tool descriptions — are content-trust problems, and Veil does not fix those. What Veil fixes is the network layer: a network-transport MCP server (HTTP/SSE) reachable from the internet is a remote tool-execution endpoint anyone can find and poke. Cloak it and only your own enrolled agents can reach it — the remote attacker is gone, and you focus on the in-context risks with guardrails.
Frequently asked questions
Does Veil stop MCP prompt injection?
No — and we won't pretend it does. Prompt injection and tool poisoning are content-trust problems inside the AI's context, not on the network. Veil controls who can reach the MCP server at all; you still need guardrails, allow-lists and human-in-the-loop for what a legitimate agent may do.
Should an MCP server be reachable from the internet?
A local (stdio) MCP server on your own machine is fine. The risk is a network-transport MCP server (HTTP/SSE) bound to a public interface — a remote endpoint that can run tools: files, shell, databases, internal APIs. If it's reachable beyond the devices that should use it, cloak it.
How do I let my team's agents reach a shared MCP server safely?
Run the MCP server on an internal host, cloak it with Veil, and issue a member for each teammate's device or agent runner. They reach the tools over a verified, MFA'd identity, with nothing listening on a public IP for a scanner to find.
Sources: CyberArk — Poison everywhere (MCP) · Cisco — MCP-Scanner