Navigating the Hurdles: Where Does Model Context Protocol Fall Short Today?

Model Context Protocol (MCP) is emerging as a promising standard for enabling large language models (LLMs) to interact more seamlessly with external tools and data sources. By providing a standardized way for applications to expose capabilities and context, MCP aims to simplify the creation of sophisticated AI agents and workflows. However, as with any nascent technology poised for widespread adoption, MCP is not without its blemishes. Current dialogue within the AI community highlights several key shortcomings that are critical areas of focus for ongoing development and implementation.

This key shortcomings of MCP highlighted within this article include:

• Significant Security Concerns
• Limitations & Standardization Gaps
• Adoption & Development Challenges

While CData MCP Servers do not resolve every challenge facing MCP development and adoption, we highlight how they mitigate some of these issues later on in the article.

Significant security concerns

A primary need for further maturity within MCP revolves around security, with concerns ranging from malicious actor exploits and data exfiltration to complexities in managing identity. In the near-term the protocol's current maturity level creates risks for organizations deploying MCP-based solutions without additional measures.

Malicious actors

The protocol's ability to grant LLMs access to external systems introduces potential vulnerabilities that require careful consideration for an enterprise. Some of the top concerns for malicious action include:

• Prompt injection, where malicious instructions embedded in user inputs or tool descriptions could lead to unintended actions by the LLM
• Tool poisoning, where attackers modify tool definitions, or rug pulls (similar to tool poisoning but occurs post-installation)
• Tool shadowing, where a malicious server creates a tool with the same name as a legitimate tool from another server to intercept calls

Ultimately, these types of attacks can compromise data or redirect actions, which is why organizations need to be discerning when it comes to the MCP tooling their teams are using.

Data exfiltration

Data exfiltration through compromised tools and remote code execution facilitated by poorly implemented MCP Servers also pose a threat. Critics note that MCP itself lacks inherent security enforcement mechanisms, relying heavily on external implementations for authentication and authorization, which were not initially well-defined within the protocol. MCP Servers requesting excessive permissions can also escalate the risk if a server is breached. The consensus is that while MCP offers powerful capabilities, robust security practices are paramount and not intrinsically guaranteed by the protocol.

Identity management

Determining clear identity management - whether requests originate from the end user, the AI agent, or a shared system account - remains an area needing clearer definition. This ambiguity poses risks for organizations deploying MCP-based solutions, particularly concerning auditing, accountability, and access control. Without a standardized way to attribute actions, it can be challenging to track who or what initiated a specific operation.

Limitations and core design challenges within the protocol

Beyond security, MCP has three key areas for further maturation with its capabilities.

Stateful protocol design

The protocol's reliance on stateful Server-Sent Events (SSE) can create significant complexities when integrating with inherently stateless REST APIs, requiring developers to manage state externally. This can be particularly challenging for remote MCP servers due to network latency and instability, complicating load balancing and horizontal scaling efforts. Maintaining persistent connections consumes more server resources and can hinder the overall resilience of the system.

Context scaling

There are also concerns that multiple active MCP connections could consume significant tokens in the LLM's context window. This can directly impact an LLM's performance, slowing down responses and potentially hindering its ability to maintain focus and reason effectively over extended or complex interactions. Large context windows are resource-intensive, and managing their consumption across many concurrent connections presents a notable challenge for LLM efficiency.

Error-handling

While basic error codes exist, MCP does not yet enforce a comprehensive error-handling standard, and its scope is currently limited to discovery and invocation, omitting crucial aspects like tool governance, versioning, or lifecycle management. This lack of complete standardization can lead to inconsistent implementations and potential interoperability challenges. Trust and reliability issues also arise, given the fallibility of LLMs and the potentially significant consequences of giving them controlling critical systems via MCP.

Adoption challenges and ecosystem immaturity

As a relatively new protocol, MCP faces the inherent challenges of early adoption and ecosystem maturity. It currently lacks widespread industry support. For example, many widely used applications and tools have yet to release MCP Server offerings, limiting the immediate practical utility of MCP for teams looking to integrate with their existing tech stacks in production. Comprehensive documentation is also lacking in certain areas. A relatively nascent developer community compared to more mature integration methods outside the context of LLMs means less peer support for those looking to leverage or build with MCP technology. This can lead to integration complexity, requiring significant system changes and a steeper learning curve for developers accustomed to traditional API approaches. 

Risk of obsolescence

The evolving nature of the standard introduces a degree of uncertainty. In the fast-paced AI landscape, there is always a possibility that the protocol could evolve so drastically that previous development is rendered obsolete, or that a completely new, competing protocol emerges and gains dominance, effectively overtaking MCP.

Potential Vendor Lock-in

As an initiative primarily led by Anthropic, there are vendor lock-in concerns and questions about fragmentation. However, Anthropic maintaining the open-source nature of the protocol and other more recent developments, such as the expansion of the MCP Steering Committee to include major players like GitHub and Microsoft, paired with OpenAI and Google each announcing MCP support, significantly mitigate these concerns, pointing towards a more collaborative and standardized future.

Where CData MCP Servers Can (& Can’t) Help

Over the past few weeks, CData kicked off the beta launch of its MCP Servers, covering widely adopted tools like Salesforce, ADP, and HubSpot, among many others—and this is just the beginning. Be sure to stay in the loop on our upcoming MCP Server releases by signing up for our content series.

While we don’t address all of the limitations noted above, here’s how CData MCP Servers can help in certain areas.

Secure access

The security vulnerabilities described earlier in the article generally pose greater issues for remote MCP Servers. In the context of local MCP Servers like CData’s current offerings, threats such as prompt injection and tool poisoning would require local machine access, reducing the attack surface exposed.

Furthermore, CData's enterprise-grade connectors, which power CData MCP Servers, support extensive authentication and encryption approaches. All CData MCP Servers support a wide range of enterprise auth flows with the backend data source out of the box, including OAuth, SAML/SSO, API keys, and JWT, complemented by TLS-encrypted transport for data in transit.

From an identity management perspective, CData MCP Servers operate within the permission sets of the credentials used to establish the connection, limiting the server's access to that of the authenticated user or service account. Best practices around identity management in the agentic space are still very much in development, but methods like creating credentials specifically for MCP/agent use may serve to aid identity management efforts while controlling access scope. CData MCP Servers also enable fine-grained access controls and audit logging. This allows administrators to precisely define which tables, columns, or operations each MCP identity can invoke and capture detailed logs of every request for enhanced compliance and auditing. 

Limitations & standardization

Like the aforementioned security vulnerabilities, MCP's reliance on stateful Server-Sent-Events poses a bigger issue for remote MCP Servers (due to network latency considerations, etc.), rendering it less applicable across CData’s portfolio of local MCP Servers.

Challenges concerning performance, reasoning, and token consumption when handling multiple MCP connections are inherent to the MCP standard and the LLMs (like Claude) that utilize it. The protocol can and LLM providers should further develop capabilities in these areas.

Furthermore, while CData MCP Servers are not able to fully overcome shortcomings related to MCP’s lack of error-handling standardization, the underlying proprietary connector technology powering them presents all data from connected sources as SQL-compliant relational tables, regardless of the original API or data store format, which can help mitigate these issues to a degree.

In particular, this tabular model means that standard database SQL errors are returned directly by the connector in the event of query issues produced by the LLM. In this case, the LLM catches and corrects these errors before a call is ever made to the data source's native API, which helps avoid unnecessary API calls, reduces load on the source system, and provides more structured and understandable error feedback. 

Adoption & development

CData aims to address the lack of widespread industry support and integration complexity by providing a suite of user-friendly MCP Servers covering our extensive portfolio of 270+ supported data sources. CData MCP Servers streamline the installation process with a wizard-based MCP Configuration Tool that also simplifies connection configuration for every server. Each CData MCP Server comes equipped with comprehensive documentation covering installation, authentication, data modeling, and integration with clients like Claude. For any answers not found within the documentation, users are able to leverage the MCP Servers forum in the CData User Community. 

Finally, CData’s model-agnostic approach should allay vendor lock-in concerns, and major players like Google and OpenAI have indicated future support for MCP, suggesting growing adoption beyond a single vendor.

Unlocking potential: MCP's path forward

Model Context Protocol represents a significant leap towards enabling AI models to interact dynamically with digital tools and data. While discussions around security, standardization, and ecosystem maturity are important, they highlight areas of active development and opportunity. CData is contributing to this evolution by providing secure, enterprise-grade MCP Servers that leverage robust authentication and access controls, easing integration complexity with comprehensive documentation and simplified installation, and supporting a model-agnostic approach. While some challenges are inherent to the current state of MCP itself, CData's offerings aim to mitigate key risks and accelerate adoption.

Explore how CData's MCP Servers can enhance your AI workflows and securely connect your LLMs to the data they need.