The exposed surface
An MCP server exposes tools, resources and prompts to an agent. Each of those objects can influence what the agent believes is available and what it attempts to do next.
The server becomes part of the trusted execution path, even when it only looks like developer convenience.
Where risk concentrates
The common risks are missing authentication, over-broad credentials, unsafe filesystem or shell access, network egress and tool descriptions that carry hidden instructions. A single weak server can give an agent a path around the intended boundary.
Inventory is necessary, but not sufficient. Teams need enforceable constraints.
How to reduce exposure
Place a control boundary in front of MCP traffic. Allow specific tools, constrain parameters, scan requests and responses, and record the policy decision. The server can remain useful without becoming an unbounded authority path.
Policy before action. Evidence after execution.