The rise of systems based on the Model Context Protocol (MCP) has revolutionized how large language models (LLMs) interact with external tools and services. This open and standardized protocol allows AI agents to delegate complex tasks — from database queries to workflow automation — to specialized servers. However, the rapid adoption of MCP has left a fundamental security problem in the background: caller identity confusion. This vulnerability, which we treat as the Achilles' heel of MCP systems, exposes organizations to serious risks ranging from data leaks to unauthorized control of critical operations.
The underlying mechanism is deceptively simple. In a typical MCP architecture, a client — for example, an LLM or an application that integrates it — communicates with one or more servers that expose tools. The problem arises because these servers, by design, often do not authenticate the identity of the caller. Once an initial authorization is granted, the state persists, and any subsequent invocation from any source within the same context is treated as legitimate. This means that a malicious actor who manages to infiltrate the same communication flow — whether through a man-in-the-middle attack, prompt injection, or a client-side vulnerability — could invoke sensitive tools without needing additional credentials.
Our conceptual analysis, based on recent studies — without copying specific data — reveals that most MCP servers rely on persistent authorization and do not implement per-tool authentication. A server might expose functions to read financial data, write to databases, or even execute commands in cloud infrastructure. If all these tools share the same trust level after a single authorization, the security perimeter vanishes. The consequence is an expanded attack surface: any call reaching the server, regardless of its origin, potentially has full access to the server's capabilities. It is, in essence, a 'blind trust' model that contradicts the most basic principles of modern cybersecurity.
From a business perspective, this weakness is especially alarming for companies that use AI agents to automate critical processes. Imagine a Business Intelligence system that, via Power BI, queries sales data through an MCP server. If that server does not verify the caller's identity beyond an initial authorization, an attacker could manipulate queries to extract confidential information or alter reports. Similarly, in cloud environments with AWS or Azure, an AI agent managing resources could be tricked into deploying unauthorized instances or modifying security configurations. The lack of granularity in authorization turns each MCP server into a potential single point of failure.
To mitigate these risks, it is necessary to rethink the trust architecture. Solutions involve implementing explicit caller authentication on each invocation — not just at the start — and granularizing permissions at the tool level. Techniques such as using tokens with limited scope, binding the caller's identity in the transport protocol (e.g., via mTLS), and continuous auditing of invocations are mandatory steps. Furthermore, adopting a zero-trust approach in MCP systems allows each request to be validated independently, drastically reducing the attack surface.
At Q2BSTUDIO, we understand that security is not an add-on but a pillar of software development. That is why, when we design custom software that integrates AI agents or protocols like MCP, we apply strong authentication and detailed authorization patterns from the start. Our experience in cybersecurity allows us to audit these systems and reinforce their weak points. Likewise, our cloud solutions (on both AWS and Azure) incorporate managed identity mechanisms that prevent caller confusion. It is not just about implementing MCP, but doing so securely and scalably. For companies seeking automation with artificial intelligence, we offer automation services that ensure every process — from data extraction to report generation in Power BI — is protected against unauthorized access.
Caller identity confusion is not a minor bug: it is a design flaw that, if not corrected, will hinder the enterprise adoption of AI agents. Organizations integrating MCP must demand from their providers — and from their own development teams — that fine-grained controls be implemented. At Q2BSTUDIO, we work with cutting-edge technologies so that our clients can harness the full potential of AI and the cloud without sacrificing security. Because, in the end, trust is not inherited: it is verified with every call.
