AI
Three Layers of MCP Security
MCP security breaks into three layers. The web layer covers basic network security. The AI firewall acts as classifier guardrails for input and output content filtering, threat detection, and spam analysis. The data and tools layer handles role-based access for APIs and secrets. Guardrails enforce predefined rules to keep AI within acceptable boundaries. Speakers noted existing software from Akamai and Cloudflare’s AI gateway for the AI firewall layer. The focus was on the data and tools layer, where RBAC and token management live.
Token Exchange and Access Control
Passing a user’s JWT or API key to an MCP server gives the server full authority. RFC 8693 token exchange wraps the user token in an on-behalf-of token, but the agent still keeps the same access scope. Elicitation forces the agent to request a new token with narrower scopes when the backend denies an action. That approach triggers user confirmation prompts, which leads to confirmation fatigue. Speakers compared RBAC, attribute-based, and task-based access control. They warned that agents follow unknown paths to a goal, unlike REST endpoints tied to known buttons.
K Agent as an Enterprise MCP Proxy
K agent is an open-source CNCF project that lets teams host MCP servers and models in Kubernetes. It provides agent-to-agent skills and the ability to remove individual tools from an agent, shrinking the context window. The demo showed OIDC authentication, Kyverno policies for resource control, and a classification model for MCP server risk levels (public, internal read, moderate read-write, production changes). Self-hosting the whole stack keeps data inside the network and supports air-gapped environments. The presenters used K agent as a proxy for GitHub’s MCP server, limiting write access for developers in VS Code.
Q&A
How is K agent used day to day? The team uses it for consulting demos and some customers have implemented it to host custom MCP servers, like one for draw.io sketches. ▶ Watch (37:10)
How to prevent agents from downloading tools? Kubernetes RBAC, network policies (e.g., Cilium), and limiting MCP skills can block outbound connections and tool downloads. AI firewalls sanitize incoming responses to prevent reverse prompt injection. ▶ Watch (41:55)
Notable Quotes
“We don’t know what choices the agents will make for us.” Awar Abdulkarim · ▶ Watch (14:13)
“The point is when you have the ability to host all of the model stack on your own, you can secure the model stack as well.” Manfred Bjørlin · ▶ Watch (33:32)
“How can we handle our keys, our secrets, and our RBAC?” Awar Abdulkarim · ▶ Watch (7:21)
Key Takeaways
- MCP security requires three layers: network, AI firewall, and data/tools RBAC.
- Token exchange (RFC 8693) alone does not restrict agent scope; elicitation with user confirmation introduces fatigue.
- K agent provides self-hosted MCP infrastructure with granular tool scoping, OIDC, and policy-as-code.
About the Speaker(s)
Awar Abdulkarim works at Sopra Steria Norway as a Senior Engineer and Lead for Cloud Native Competency group. His experience covers containerized applications, Kubernetes platforms, and DevOps-centric strategy.
Manfred Bjørlin is a Principal Cloud Native architect and developer with over 20 years of back-end development experience. He has worked with .Net since early 2000 and Azure since launch, and has a passion for neurodiversity and diversity in tech.