MCP Security: Authentication, Data Masking, and Threat Surface Management
MCP exposes enterprise business actions to AI agents — a different threat surface than traditional APIs, requiring specific security controls at every layer.
The MCP Threat Surface
MCP exposes enterprise business actions to AI agents. The threat surface is different from a traditional API: the consumer is an AI that makes decisions based on tool descriptions and context, not a developer following explicit instructions. This creates attack vectors that don't exist in developer-facing APIs.
Prompt injection via tool responses: A malicious value in a tool response could instruct the agent to take unintended actions. Tool responses must be sanitized before they reach the agent context. Never pass raw user-generated content or external data directly through tool responses without sanitization.
Scope creep via chained tool calls: An agent with access to multiple tools might chain them in ways that exceed intended scope. Governance must be applied at the individual tool level, not just at agent onboarding. An agent that can read sensitive data and send emails should not be able to combine those capabilities without explicit authorization.
Credential exposure: MCP tools use enterprise credentials to access business systems. These credentials must be managed through Workato's secure connection store — never embedded in tool definitions, never passed through agent context.
Authentication Architecture
Workato's Enterprise MCP uses connection-based authentication. Each MCP server is associated with a Workato connection that holds the credentials for the target system. When an agent calls a tool, the connection credentials are used server-side — they are never passed to the agent or exposed in the tool response.
This architecture means a compromised agent context cannot extract enterprise credentials. The agent can call tools and receive results, but it cannot see the credentials that authenticated those tool calls.
Security Hardening Checklist
- All credentials stored in Workato connection store — none embedded in tool definitions
- Tool responses sanitized before reaching agent context
- Sensitive fields masked at the tool response layer
- Irreversible tools require approval — no autonomous execution of deletions or high-value transactions
- Agent-tool access follows least-privilege principle
- Tool call logging enabled with appropriate retention
- Regular access review of which agents can call which tools
- Anomaly alerting configured for unusual tool call patterns