CAIN-42 CAIN StudioCMSE · Module 1 of 5 · 12 min
How MCP works, and where it breaks
The Model Context Protocol lets an agent discover tools on a server and call them. Each tool publishes a name, a description and a parameter schema. The agent reads the description to decide when and how to call it.
That design creates the attack surface: whatever is in the description becomes part of the agent's instructions; whatever the schema allows becomes reachable; whatever the server returns flows back into the agent's context.
Common failure classes include tool poisoning, tool shadowing, excessive permissions, token misuse, command injection, server-side request forgery and supply-chain compromise of the server itself.
Key points
- Tools = name + description + schema.
- Descriptions are read as instructions.
- Schemas define what is reachable.
- Returns flow back into context.
In the CAIN-42 codebase
mcp-security-scanner/engine.py— deterministic detector for MCP tool definitions
Practice check
Practice 1 · choose one
What does the agent read to decide how to use an MCP tool?
Practice 2 · true or false