Model Online / On-Site
Duration
Modules 5 modules

Course Objective & Scope

As developers and business users rapidly connect third-party Model Context Protocol (MCP) servers and prebuilt tool packages to IDEs, desktop assistants and enterprise agents, a major new supply chain attack surface has emerged. Hidden instructions inside an MCP tool description can exfiltrate data from another server, or a silently mutated tool definition (rug pull) can hijack agent behaviour.

This course examines MCP protocol internals, tool poisoning, tool shadowing, credential leakage and multi-agent (A2A) supply chain risks through hands-on labs, guiding participants to design an approved enterprise MCP registry, gateway and security standard.

Who Should Attend?

  • AI and platform engineers building MCP servers and clients
  • Security teams governing AI-assisted IDEs (Cursor, Claude Code, Copilot) and enterprise agents
  • Application security (AppSec) and software supply chain security specialists
  • Prerequisite: familiarity with JSON-RPC / API integrations and LLM tool calling

Key Takeaways

  • Analyse trust boundaries across host, client and server components in the MCP architecture
  • Demonstrate tool description poisoning, cross-server tool shadowing and rug pull attacks in the lab
  • Verify MCP servers using code review, static/dynamic scanning and schema pinning/signing
  • Enforce authentication, permission filtering and payload inspection on an enterprise MCP gateway
  • Establish an approved MCP server catalogue and onboarding policy for IDEs and enterprise agents

Curriculum

The Supply Chain Surface of MCP and the Agentic Ecosystem
  • MCP architecture (Host, Client, Server; Tools, Resources, Prompts, Sampling) and stdio vs HTTP/SSE transports
  • Risks of open-source MCP packages, ephemeral npx/uvx execution and unverified plugins
Tool Poisoning, Shadowing and Rug Pull Attacks
  • Hidden instructions embedded inside tool descriptions and parameter schemas
  • Cross-server tool shadowing of trusted connectors (e.g. email, GitHub) and post-approval rug pulls
Exploitation and Detection Lab
  • Exfiltrating SSH keys or corporate data via a trojanised MCP server in a sandbox
  • Scanning MCP schemas, tool descriptions and runtime traffic with security inspection tools
Secure MCP Server Development and Deployment
  • Pinned versions, cryptographic schema hash pinning and containerised isolation
  • OAuth 2.1 authorization for MCP, least privilege and restricting client-side sampling
Enterprise MCP Gateway and Governance
  • Central MCP proxy/gateway enforcing tool allowlists, description sanitisation and rate limits
  • Operating an approved internal MCP registry for developer workstations and production agents

Other Courses in This Category

  • Preventing Unexpected Code Execution in LLM and Agent Systems

    Teaches how to prevent remote code execution (RCE) and injection vulnerabilities caused by executing LLM- and agent-generated Python, SQL, shell or template outputs using AST validation and safe output handling.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • Sandboxing and Isolated Execution Environments for AI Agents

    Teaches how to isolate code-executing, file-processing and browser-using AI agents inside secure sandboxes using Firecracker microVMs, gVisor, Kata Containers, WebAssembly and strict network egress controls.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • Prompt Injection Attacks and Defenses for LLM Applications

    Hands-on training on direct prompt injection, jailbreak techniques and system prompt leakage, showing developers how to detect and defend against them with input classifiers, instruction hierarchy and tools such as garak.

    AI Security & Red Teaming Corporate
    Live Course
    6 modules
    View
  • Indirect Prompt Injection in RAG and Agent Systems

    Covers hidden instructions delivered through web pages, emails, documents, RAG sources and MCP tool outputs, data exfiltration chains, and architectural defences such as spotlighting, the dual-LLM pattern and CaMeL.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • Sensitive Data Exposure in LLM Applications

    Teaches how sensitive data leaks from LLM applications through memorisation, secrets in system prompts, unauthorised RAG access, cross-tenant leakage and logs, and how to prevent it with permission-aware retrieval and DLP controls.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View
  • Tool Misuse and Excessive Agency in AI Agents

    Shows how to control excessive functionality, permissions and autonomy granted to AI agents using tool design, parameter validation, approval flows and an agent permission matrix, based on OWASP LLM06 and agentic risk guidance.

    AI Security & Red Teaming Corporate
    Live Course
    5 modules
    View

Get in touch