Episode
The MCP Security Risks You Can't Afford to Ignore
- Podcast
- Tech Lead Journal
- Published
- Mar 2, 2026
- Duration seconds
- 4339
- Processing state
not_requested
Actions
POST https://stenobird.com/v1/public/podcasts/tech-lead-journal-633005/episodes/the-mcp-security-risks-you-can-t-afford-to-ignore/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/tech-lead-journal-633005/the-mcp-security-risks-you-can-t-afford-to-ignore.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
What if the MCP server you installed last week is silently leaking your emails to a stranger? The AI tools boosting your productivity could already be your biggest security liability. MCP (Model Context Protocol) has quickly become the standard for connecting AI agents to external tools and data sources. But as adoption accelerates, so do the risks – from malicious servers harvesting your credentials in the background, to local processes exposed to your entire network with no authentication. Most developers install MCP servers without fully understanding what code is running or who wrote it, creating serious supply chain and shadow IT problems inside organizations. In this episode, Ariel Shiftan, CTO of MCPTotal, explains how MCP actually works, why there is a wide gap between its original design and how it is used in practice, and what that gap means for security. He also walks through real zero-days his team has discovered and shares practical advice for developers and enterprise leaders trying to adopt MCP without compromising their security posture. Key topics discussed: What MCP is and why it won the “USB for AI” race Why most MCP servers are just API wrappers done wrong Real zero-days found in popular, widely used MCPs How malicious MCPs can silently leak your credentials The supply chain risks hiding inside your dev toolchain Why banning MCP in your org is the wrong move Best practices for writing well-designed MCP servers Why agent permission prompts need better security defaults Timestamps: (00:00:00) Trailer & Intro (00:02:49) What Is MCP and Why Is It Called the USB for AI? (00:07:22) How Does MCP Differ from Standard REST APIs? (00:13:40) What Can AI Agents Do with MCP Beyond Reading Data? (00:16:56) What Is RAG and How Did AI Evolve to Tool Calling? (0…