Governance and Security of APIs and MCPs
summary
Argues that an MCP server is optional — agents can call libraries or function APIs — and warns that wrapping insecure APIs creates bigger risks. Calls for design MCPs for agent consumption with coarser tool granularity, strict descriptions to avoid prompt-injection, and agent identities/least-privilege. Cites real harms: $47,000 bill from looping agents and an agent deleted production database. Recommends gateways, automated contract and security tests, registry hygiene, and runtime monitoring because MCPs are often dynamic, not static.
AI-written summary · about
chapters (11)
- 0:00API and MCP governance intro
- 1:11Need an MCP server?
- 4:23API governance for MCPs
- 8:39Designing MCPs for agents
- 13:40MCP description security risks
- 16:08Securing APIs before MCP
- 17:54Agent identity and permissions
- 20:01Validating MCP contracts
- 21:05MCP security testing
- 22:32Dynamic MCP registry risks
- 24:18Monitoring MCP usage
related talks
17mBuilding Production-Ready MCP Servers: From AI Agents to Secure Enterprise APIs.
26mWho Let the Agent In? Securing MCP Servers in Production
50mMCP at Scale: Governing AI Agent APIs When Autonomous Systems Are Your Consume…
29mMCP Security: Keep Your AI Agents from Spilling the Tea
36mSecuring MCPs for Production
45mAPIs are the best protection for your AI strategy -
21mMCP Best Practices
15mWhy Security Matters: The Risks of Agentic AI and How to Mitigate Them