MCP Enterprise Security

You shouldn't deploy MCP in production without a plan. 43% of public MCP servers have command injection vulnerabilities, and most enterprises are connecting them to live data warehouses. Safe deployment requires isolation at three points: the network, the application, and the runtime. Strake provides this by default, using Firecracker MicroVMs to house execution so a malicious prompt can't touch your host system.

Risk Assessment

The reality of the threat

The danger isn't just a "bad" agent; it's what an agent can do once it has warehouse access. SQL exfiltration and session poisoning aren't theoretical — they are the default state of insecure MCP implementations.

Prompt Injection

A clever prompt can still "dump" tables if your engine doesn't enforce read-only boundaries.

SQL Exfiltration

Agents are surprisingly good at crafting queries to extrude data to external endpoints.

Session Tainting

Data from one user leaking into another's agent session because of shared resources.

Safety Protocol

Secure Deployment Model

Network

Air-gap the sandbox. Isolation isn't enough; the environment where code runs should have zero outbound internet access unless you've explicitly whitelisted it.

Application

Don't trust the prompt. Every query needs inspection for PII and injection patterns at the engine layer before it ever reaches execution.

Runtime

Containers are not a security boundary. Firecracker MicroVMs provide hardware-level isolation, ensuring a script can't escape to the host even if it cracks the sandbox.

Production Ready

The Secure MCP Checklist

1. Network Isolation: Sandbox must be air-gapped.
2. Prompt Injection Detection: Pre-execution filtering.
3. Runtime Sandboxing: Firecracker MicroVM isolation.
4. Read-Only Enforcement: No write permissions by default.
5. Session Taint Tracking: Prevent cross-pollination.
6. SQL Exfiltration Prevention: Pattern-based blocking.
7. Context Quotas: Prevent DoS through overflow.
8. Filesystem Restriction: Landlock/Seccomp enforcement.
9. PII Masking: Scrub results at the engine layer.
10. Audit Logging: Full transparency for every query.
11. Rate Limiting: per-session resource control.
12. Vulnerability Scanning: Continuous implementation checks.