Skip to main content

MCP Hardening

Controls which external tool servers your agent can connect to and inspects their responses.

note

This guard is primarily relevant if your agents connect to external tool servers via MCP. If your agents don't use MCP integrations, this guard runs silently in the background with nothing to monitor.

What It Does​

MCP (Model Context Protocol) lets your agent connect to external tool servers -- databases, APIs, third-party integrations, and more. Each server your agent connects to is a potential entry point for attacks. A compromised or malicious server could send back manipulated responses designed to take control of your agent, steal data, or trigger unintended actions.

MCP Hardening acts as a firewall for your agent's external connections. It requires you to explicitly approve which servers your agent can talk to, restricts how those connections are made, and inspects everything coming back from MCP servers for signs of tampering. Only approved connections get through, and all responses are checked before the agent sees them.

Think of it as a customs checkpoint. Every package (response) arriving from outside is inspected, and shipments from unapproved senders are turned away at the border. If your agent does not use any MCP servers, this guard has no overhead -- it only activates when external tool connections are in use.

Why It Matters​

Every MCP server your agent connects to extends your attack surface. A single compromised server can inject instructions into your agent's workflow, potentially accessing data from other connected services or performing actions the server was never intended to trigger. Without explicit controls, your agent could also be tricked into connecting to unauthorized servers, leaking sensitive information to untrusted endpoints.

This guard is essential for any deployment that uses MCP servers. The more external integrations your agent has, the more important it becomes to control and monitor those connections.

What Gets Caught​

  • Unapproved MCP servers — any tool call to an MCP server that isn't on your allowlist
  • Unapproved connection methods — attempts to connect using transport protocols you haven't explicitly allowed
  • Suspicious responses — MCP server responses that contain manipulation patterns (e.g., instructions trying to override the agent's behavior)
  • Malicious parameters — tool call parameters that target internal network addresses or attempt SSRF (server-side request forgery — tricking a server into making requests to unintended destinations)

What won't trigger it: Tool calls to approved MCP servers using approved transport methods. If you're adding a new MCP server and it's being blocked, add it to the allowlist in the dashboard. If response scanning is flagging legitimate responses, you can create an exemption for that server.

Example​

Scenario

An agent attempts to connect to a new MCP server at mcp.example.com to use a database tool. MCP Hardening checks the server against the allowlist and finds it hasn't been approved. The connection is blocked — the agent cannot communicate with the server. The audit log shows an unapproved_server event with the server address and the skill that attempted the connection. An administrator can add the server to the allowlist in the dashboard if the integration is legitimate.

Settings​

SettingWhat It Controls
AllowlistWhich MCP servers your agent is approved to connect to
Block by DefaultWhether all servers must be explicitly approved before use
Allowed TransportsWhich connection methods (local, network) are permitted
Response ScanningWhether to inspect responses coming back from MCP servers for signs of tampering
ExemptionsAllow specific skills broader MCP access when needed

How It Responds​

Connections to servers that are not on your approved list are blocked outright -- the agent cannot communicate with them. Responses from approved servers that contain suspicious content are flagged for review.

If This Guard Blocks You​

  1. Check the audit log. Navigate to Security > Audit Log in the CrabShack dashboard. Filter by MCP Hardening to find the relevant event. Click on the event row to expand it and see details including which skill and channel triggered it, the session key, and additional context.

  2. Understand the detection. The audit log shows which MCP server was blocked and why — unapproved_server (not on the allowlist), unapproved_transport (connection method not permitted), suspicious_response (the server's response contained manipulation patterns), or ssrf_attempt (server-side request forgery — tool parameters targeting internal network addresses). If a legitimate MCP server is being blocked, add it to the allowlist in the dashboard and ensure the transport method (local or network) is also permitted. If response scanning is flagging legitimate responses from an approved server, create an exemption for that server.

  3. Adjust if needed. Add approved servers to the MCP Hardening allowlist. Enable the required transport methods. Create exemptions for specific skills that need broader MCP access. See the Configuration page for details.

tip

Prefer creating a targeted exemption for a specific skill or channel over disabling the guard entirely. If you're seeing frequent false positives, a suppression lets you silence a specific detection label temporarily while you refine your settings.

Default Behavior​

The guard blocks by default -- no MCP servers are permitted until you explicitly add them to the allowlist. Only local connections are allowed, preventing agents from reaching remote servers unless you specifically enable it. Response scanning is on. This is intentionally strict because external connections represent one of the highest-risk areas for AI agent security.

  • Tool Gate -- Provides general control over which tools your agent can use. MCP Hardening adds specialized protection for external tool server connections.
  • Network Policy -- Controls broader network access. MCP Hardening focuses specifically on the MCP protocol layer.
  • Prompt Injection -- Detects manipulation in messages. MCP Hardening applies similar protection to content arriving from external tool servers.