What is an MCP server?
An MCP server exposes tools and data to AI agents through the Model Context Protocol, and calls other systems using its own credentials.
{
"servers": {
"crm": {
"command": "npx",
"args": ["-y", "crm-mcp-server"],
"env": { "CRM_TOKEN": "••••••" }
}
}
}- An MCP server exposes tools to agents and calls other systems with its own credential.
- Every agent allowed to call it inherits that credential reach.
- Local and remote servers fail differently: a token on a machine, or a breach at an operator.
- Its tool descriptions are agent input, which makes provenance an access question.
Published Last reviewed
In practice
From a security point of view an MCP server is a non-human identity. Whatever credentials sit behind its tools, such as API keys, OAuth tokens or service accounts, define what an agent using it can reach. A server shared by several agents concentrates their access.
See MCP server access and our MCP security checklist.
An MCP server exposes tools and data to AI agents through the Model Context Protocol, and calls other systems using its own credentials.
The parts, and where each one fails.
Four parts, each of which is somebody else problem in a typical review.
| Part | What it is | How it fails |
|---|---|---|
| Tools | What the agent can call. | Broader than the task needs. |
| Credential | What the tools authenticate with. | One credential wide enough for every tool. |
| Transport | Local process, or remote over HTTP. | Plain text token, or an operator breach. |
| Descriptions | How the agent decides what to call. | Untrusted text entering agent context. |
How it works. Step by step.
The parts that make it up, in an environment with AI agents.
The server exposes tools and data an agent can call.
Each tool calls other systems with the server’s own keys or tokens.
Several agents can call the same server and inherit its access.
Whatever those credentials reach is reachable by every agent using it.
What it looks like in Elmoz
A real path shape, drawn the way the Elmoz security graph shows it.
Questions, answered.
Short answers about MCP server.
Is an MCP server a non-human identity?
In practice yes. It calls other systems with credentials such as API keys, OAuth tokens or service accounts, and those credentials define what it can reach.
What is the difference between local and remote MCP servers?
Local servers usually run on the user’s machine over stdio and use credentials from local config. Remote servers are reached over HTTP and handle authentication themselves, often with OAuth.
How do I secure an MCP server?
Scope the credentials behind each tool, avoid long-lived static keys, give shared servers their own identity per agent where possible and review which agents can call it.
Keep reading.
Pages that belong to the same picture.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.