Connecting AI to everything
Nov 12th, 2025 by Jesper Kråkhede
This year the Model Context Protocol, MCP, has become the common way to connect AI agents to tools and data. It is an open standard, and the idea is simple. A server exposes tools, like ‘search tickets’ or ‘send mail’, and any agent that speaks MCP can use them. The big platforms have adopted it, and thousands of MCP servers are available.
It is a great idea for productivity. From a security point of view, it means every AI agent can potentially be connected to every system you have. So let me suggest some architecture principles.
Treat MCP servers as applications in your supply chain. Only use servers from sources you trust, review what they do and keep them updated. A malicious or compromised MCP server can feed the agent hidden instructions or take actions you didn´t intend.
Authenticate everything. The agent should have its own identity, the server should verify it, and the permissions should be scoped to what that agent needs. Avoid servers that run with a shared, broad token.
Separate read from write. Tools that only read are much less risky than tools that send mail, change configurations or move money. Require human approval for the dangerous ones.
Watch out for the combination. An agent that reads untrusted content, has access to sensitive data and can send data out is the recipe for data leakage. Break at least one of the three.
And log every tool call, so you can see what the agent actually did.
Agents need integration. Give them doors, not master keys.