What is an MCP server?

An MCP server exposes tools and data to AI agents through the Model Context Protocol, and calls other systems using its own credentials.

Book a demoAll terms

.vscode/mcp.json

{
  "servers": {
    "crm": {
      "command": "npx",
      "args": ["-y", "crm-mcp-server"],
      "env": { "CRM_TOKEN": "••••••" }
    }
  }
}

MCP SERVER

In practice

From a security point of view an MCP server is a non-human identity. Whatever credentials sit behind its tools, such as API keys, OAuth tokens or service accounts, define what an agent using it can reach. A server shared by several agents concentrates their access.

See MCP server access and our MCP security checklist.

DEFINITION

An MCP server exposes tools and data to AI agents through the Model Context Protocol, and calls other systems using its own credentials.

HOW IT WORKS

How it works. Step by step.

The parts that make it up, in an environment with AI agents.

01Tools

The server exposes tools and data an agent can call.

02Credentials

Each tool calls other systems with the server’s own keys or tokens.

03Shared use

Several agents can call the same server and inherit its access.

04Reach

Whatever those credentials reach is reachable by every agent using it.

EXAMPLE

What it looks like in Elmoz

A real path shape, drawn the way the Elmoz security graph shows it.

Security GraphFocus: Cursor agentAll assetsIdentitiesData stores

ATTACK PATH1 API call · 9 seconds

FAQ

Questions, answered.

Short answers about MCP server.

Is an MCP server a non-human identity?

In practice yes. It calls other systems with credentials such as API keys, OAuth tokens or service accounts, and those credentials define what it can reach.

What is the difference between local and remote MCP servers?

Local servers usually run on the user’s machine over stdio and use credentials from local config. Remote servers are reached over HTTP and handle authentication themselves, often with OAuth.

How do I secure an MCP server?

Scope the credentials behind each tool, avoid long-lived static keys, give shared servers their own identity per agent where possible and review which agents can call it.

Related terms.

Terms that belong to the same picture.

Non-human identity (NHI)A non-human identity is a digital identity assigned to software or services rather than a.Read definition →Agent data reachAgent data reach is the set of sensitive data an AI agent can eventually access through.Read definition →Blast radiusBlast radius is the set of systems and data affected if a single identity, credential or.Read definition →Attack paths guideHow agents reach sensitive data, step by step.Read the guide →

See what your agents can reach. Before someone else does.

Book a demo and we walk through the access paths in an environment like yours.

Book a demoRead the attack path guide