Your Insecure MCP Server Won't Survive Production — Tun Shwe, Lenses
Lenses.io experts Tun Shwe and Jeremy Frenay discuss the significant security and design hurdles in transitioning Model Context Protocol (MCP) servers from local development to enterprise production. They introduce five core principles for secure agentic design, including shrinking the attack surface and constraining inputs, and detail the necessity of remote MCP servers with robust authentication. The talk provides an in-depth comparison of OAuth 2.1's Dynamic Client Registration (DCR) and the more secure Client ID Metadata Document (CIMD) approaches for managing agent identities, offering a roadmap for building enterprise-grade agentic AI systems with MCP.
This session addresses the critical security and design challenges associated with deploying Model Context Protocol (MCP) servers in enterprise production environments. Tun Shwe and Jeremy Frenay from Lenses.io highlight that while local MCP setups are convenient for development, they are inherently insecure and unscalable for professional workloads. They advocate for a shift to remote MCP servers, emphasizing that robust agentic design is inextricably linked with security.
The Inherent Insecurity of Most MCP Servers
Jeremy Lowin, creator of Fast MCP, noted that agents deserve an interface optimized for their use cases. The speakers extend this by stating that a badly designed MCP server is also a badly secured one, with poor design and security compounding each other. They identify three key differences between human and agent interactions, each casting a “security shadow”:
- Discovery: Humans scan documentation once; agents enumerate every tool and read every description upon connection, which is token-expensive. The security shadow here is tool poisoning, where attackers can embed hidden, malicious instructions in tool descriptions, invisible to humans but followed by the model. More tools mean a larger surface area for injection.
- Iteration: Humans can quickly re-run failed scripts. Agents, however, send the full conversation history with every retry. This creates a data leakage risk, especially when interacting with a poorly scoped MCP server, broadcasting sensitive data with each round trip.
- Context: Humans possess vast accumulated knowledge; agents are limited by a token window (e.g., 200,000 tokens). This leads to context injection and oversharing (OWASP MCP Top 10, #10). If unfiltered data is dumped into this window, PII, credentials, or internal system details can be exfiltrated via prompt injection. Agents loading all context before decision-making can also be tricked if some of that