When the National Security Agency publishes a document about a piece of developer infrastructure, the infrastructure has stopped being a developer concern. The NSA's Artificial Intelligence Security Center has released a Cybersecurity Information Sheet on the Model Context Protocol — the open standard that lets AI agents call tools, read files, and reach into the systems around them. The headline framing is the usual one: heightened scrutiny before you wire this into anything high-assurance. The interesting part is why, and the why is not a bug. It's the shape of the thing.
The direction of trust
Here is the sentence to sit with. In a normal client-server relationship, the client reaches out and the server answers: your browser asks, the website responds. MCP often runs the other way. The protocol expects servers to query the connected client and, frequently, to drive it — to surface tools the client should call, to request actions, to push capability into the model's context. The agent is not the thing in charge. The thing on the far end of the connection is.
That inversion is the entire security story, and it is why the NSA's guidance reads less like a patch list and more like a warning about a category. Decades of network defense assume a known direction of intent. Clients inside the perimeter reach outward; you inspect what leaves and what tries to come in. MCP traffic does not respect that geometry. The tool calls and capability negotiations move along channels your filters were never pointed at, which is why the guidance reaches for a phrase that should make any security team sit up: a perimeter bypass. Standard network filters miss the traffic not because it's encrypted or hidden, but because it's flowing in a direction the filter doesn't think exists.
The agent is not the thing in charge. The thing on the far end of the connection is.
Flexibility as a vulnerability
The deeper indictment in the guidance is that MCP shipped flexible and underspecified — and that the flexibility is the flaw. A protocol that leaves "safe usage" to the implementer has not deferred the security work; it has distributed it to thousands of people who will each get it slightly wrong. The document flags the predictable consequences: overlapping contexts leaking sensitive state from one task into another, unverified dynamic tool discovery letting a compromised module expand its blast radius, and serialization faults that an attacker can chain with prompt injection to reach full remote code execution.
None of this is hypothetical. Researchers have already documented a by-design weakness in MCP that enables RCE across the AI supply chain, and the protocol's own SDKs have carried real CVEs — including one where a single reused server instance leaked responses across client boundaries. The NSA didn't discover a new exploit. It read the design and described, in the measured voice of a federal advisory, what was always going to happen when you give a server the power to drive a model and then tell everyone to figure out the guardrails themselves.
The fix is the part nobody built
What the guidance asks for is almost aggressively unglamorous: observability. Log every tool invocation and every model call. Capture the exact parameters, the identities involved, and cryptographic hashes of the results. Make the whole thing reconstructable after a breach. That is the backbone of forensic response, and it is precisely the layer that the agent gold rush skipped, because logging every tool call is the opposite of a demo. Nobody films the audit trail.
This is the recurring pattern in agent infrastructure and it deserves to be named plainly. The capability ships first because the capability is what's exciting; the accountability ships later, if at all, because accountability is what's expensive. MCP let agents touch real systems in 2025. The guidance on how to watch them do it is arriving now, from the NSA, after the protocol is already inside production stacks at organizations that could not tell you, today, what their agents called yesterday.
The policy reading is straightforward. When a signals-intelligence agency writes design considerations for your tooling, regulated industries take it as a floor, not a suggestion — and procurement language starts to ask whether your MCP deployment can produce that forensic record on demand. The protocol that won by being open and easy is about to meet the part of the market that buys on whether you can prove what happened. The guidance is not telling anyone to stop using MCP. It is telling them that "we connected the agent to everything and pointed the firewall the usual way" is no longer an architecture. It's a finding waiting for an auditor.
