Assessing MCP tool risk

[00:00:01]Hey, my name is Kai Hendry. I'm a consultant with ThoughtWorks.

[00:00:06]And in my current role, I'm a security engineer helping to roll out MCPs in a large organization. So, if you're like me doing risk assessments with MCPs trying to work out what is the risk of rolling out uh Gmail MCP which essentially connects your cloud agent or whatever your agent you you use, your AI use with the potential of all that that that company data and email.

[00:00:37]Likewise, Slack and whatever the Atlassian, whatever vendors the particular organization uses. So, let me show you the tool so you can better understand it that can help you do these security decisions, right?

[00:00:53]So, for example, let's choose something innocuous like the AWS Docs MCP server.

[00:01:01]Now, that doesn't have any hints set.

[00:01:06]So, these annotation hints feed into your risk assessment or your your judgment call. And they don't have any set, so they're assumed to be quite conservative like they the tool can potentially be destructive potentially go open world and such and so forth. So, AWS Docs AWS Docs doesn't set these ones. But let me show you one that does.

[00:01:30]For example, uh the FastMail one.

[00:01:34]FastMail is an email provider that I use.

[00:01:39]And the cool thing about the tool is that it's able to do the OAuth dance.

[00:01:46]Ooh, I need to put in my password.

[00:01:52]Here we go.

[00:01:53]And now you see all the tools exposed by the Fast Mail MCP.

[00:02:00]And for example, the the most controversial one is is perhaps sending email.

[00:02:08]And you can see that the hints are kind of correctly set here. For example, open world hint. This is this is like the exfiltration path.

[00:02:19]Hopefully you're familiar with the lethal tri factor. This is declared true. So, of course, if you had to make a judgment call about which tools to enable in as a policy in your company, this is perhaps how you would rank them like if they were if they were hinted like this. Of course, again, you must interpret them like for example, delete email is destructive hint false.

[00:02:48]Which which is potentially arguable, but maybe it's it's declared false for a reason cuz it's able to that that risk.

[00:02:59]So, anyway, this tool is called MCP hints.

[00:03:03]Your comments, your likes, your stars would be much appreciated. Thank you.