Who Let the Agent In? Securing MCP Servers in Production
summary
Claim: MCP servers are widely exploitable — usage doubled in four months, 48% production agents run unsecured, 54% report incidents and only 9.5% know how to secure them. Practical fix: add cryptographically verifiable agent identity, a proxy-based MCP gateway that does credential brokering, and policy-driven contextual authorization (demo uses OpenFGA patterns) to swap static API keys for per-action short-lived credentials. Gravitee shows the same controls via a managed no‑code proxy, trading small latency for enforced safety.
AI-written summary · about
chapters (16)
- 0:00MCP agent security intro
- 1:55AI agent security importance
- 3:01MCP security gaps stats
- 4:07MCP basics and risks
- 6:39MCP breach timeline
- 8:28MCP tool call vulnerabilities
- 9:55Authentication flaws
- 11:00Policy-based authorization
- 12:05AI agent security pillars
- 13:52Agent-first security need
- 15:17Runtime governance
- 17:27MCP proxy intro
- 19:10Credential brokering
- 20:59Agent-IKM vs IAM
- 22:49Delegation with Agent-IKM
- 23:31Resources and next steps
related talks
26mGovernance and Security of APIs and MCPs
29mMCP Security: Keep Your AI Agents from Spilling the Tea
52mAI Agents Need Permission Slips
23mIdentity Best Practices to Secure & Scale Agentic AI / MCP Deployments
26mSecure Your MCP Servers with OAuth, JWT, SPIFFE and More
13mCloud MCP Servers Under Fire
25mYour Insecure MCP Server Won't Survive Production
55mYour MCP Server is Bad (and you should feel bad)