Posts Tagged ‘ModelContextProtocol’
[VoxxedDaysTicino2026] Why Security Matters: The Risks of Agentic AI and How to Mitigate Them
Lecturer
Christoph Bühler is a Research Assistant at the University of St. Gallen, focusing on software engineering, programming languages, system security, and infrastructure as code. His work explores securing AI applications. Relevant links include his LinkedIn profile (https://ch.linkedin.com/in/christoph-b%C3%BChler-a3a262270) and institutional page (https://programming-group.com/members/buehler).
Abstract
This article investigates Christoph Bühler’s discourse on agentic AI security, spotlighting vulnerabilities in tools like Model Context Protocol (MCP). It analyzes risks from function calling, proposes permission-based controls, and evaluates efficiency. Encompassing industry trends, academic citations, and future behavior analysis, it underscores mitigation’s urgency.
The Ascent of Agentic AI and Emerging Vulnerabilities
Christoph traces AI’s rapid evolution, from OpenAI’s valuation surge to widespread developer adoption, as evidenced by surveys and citations of foundational papers. The shift to agentic systems, where LLMs interact via tools and MCP—a JSON-RPC interface—marks a pivotal change. This enables dynamic actions but introduces risks, as agents inherit full user privileges. Real-world incidents, such as database deletions or drive wipes, illustrate how unchecked agents can cause harm. Contexts include the non-deterministic nature of LLMs, complicating safeguards, and prompt injections exploiting natural language weaknesses. The implications are severe, eroding trust and exposing systems to exploits that deterministic tools might prevent.
Permission-Based Controls as a Foundational Mitigation
To address these, Christoph proposes encapsulating MCP servers with permission-based access controls, akin to mobile app permissions. Developers define capabilities—file read/write, network domains—ensuring agents operate within bounds. This deterministic layer confines executions, blocking unauthorized accesses like SSH key theft. The methodology wraps servers in Docker, mapping policies to runtime constraints, with minimal overhead (0.6ms). Contexts involve compatibility with existing MCP implementations, allowing seamless adoption. The implications enhance safety without sacrificing functionality, providing a practical barrier against non-deterministic behaviors.
Extending Mitigation Through Behavior Analysis
Christoph outlines future directions, including runtime isolation for behavior analysis. Agents run unrestricted, with post-execution assessments distinguishing benign from malicious actions. This helps predict risks from prompt-agent interactions, aiding practitioners in safeguarding applications. Contexts draw from malware detection traditions, adapting them to AI’s unique challenges. The implications offer proactive tools for threat anticipation, complementing permission controls in a comprehensive security strategy.
Broader Ramifications for AI Governance
The talk emphasizes confining AI to avert historical errors like viruses. By prioritizing transparency and controls, developers can harness agentic potential responsibly. The contexts reflect industry hype outpacing security, necessitating balanced approaches. The implications advocate for human-centric governance, ensuring AI augments rather than endangers.
Links:
[reClojure2025] Writing Model Context Protocol (MCP) Servers in Clojure
Lecturer
Vedang Manerikar is the founder of Unravel.tech and a veteran software architect with over 15 years of experience in the Clojure ecosystem. Previously serving as the Head of Backend Engineering at Helpshift, Vedang has managed large-scale distributed systems and led complex technical migrations. At Unravel.tech, his work focuses on the intersection of Clojure and Artificial Intelligence, specifically building “Agentic Systems” and implementing Generative AI (GenAI) and Large Language Model (LLM) solutions. He is the author of mcp-cljc-sdk, a cross-platform Clojure SDK for the Model Context Protocol.
Abstract
The rapid advancement of Artificial Intelligence has created a need for standardized communication between AI agents and external systems. The Model Context Protocol (MCP), introduced by Anthropic, has emerged as a solution to the integration problem, providing a common interface for agents to interact with diverse data sources and tools. This article explores the architecture of MCP and argues that Clojure is uniquely positioned as an ideal language for implementing MCP servers. We analyze the protocol’s similarity to the Language Server Protocol (LSP), examine real-world applications in browser automation and communication platforms, and discuss how Clojure’s REPL-driven development and data-centric philosophy streamline the creation of powerful, composable AI workflows.
The Model Context Protocol: A New Standard for AI UX
At its core, MCP is an open standard designed to enable AI applications—such as Claude Desktop or Cursor—to access the external world in a structured manner. While one might ask why standard HTTP interfaces are insufficient, the answer lies in the integration problem. Without a standard, every AI agent would need a custom integration for every service (PostgreSQL, Google Drive, GitHub, etc.). MCP solves this by acting as a “USB port” for AI; developers write a server for their service once, and it becomes immediately accessible to any MCP-compliant agent.
Vedang describes MCP not just as a data access layer, but as a “baseline AI UX.” It defines how an agent discovers tools, reads resources, and follows prompts. This standardization allows for the creation of sophisticated workflows where an agent can, for example, use a Playwright MCP server to browse Hacker News, a WhatsApp MCP server to read messages, and a local filesystem server to summarize information and save it to a document. By providing a consistent interface, MCP shifts the focus from integration plumbing to the design of the agent’s behavior and user experience.
Clojure as the Premier Language for MCP
Clojure’s technical characteristics align remarkably well with the requirements of building MCP servers. The protocol is heavily reliant on JSON-RPC and the exchange of structured data, which plays directly into Clojure’s “data-as-code” philosophy. Vedang highlights several key reasons why Clojure developers are particularly well-prepared for the LLM world:
1. REPL-Driven Development: MCP servers often act as intermediaries between non-deterministic LLMs and deterministic systems. The ability to interactively test and refine server responses in a live REPL mirrors the iterative nature of working with AI.
2. Data Transformation: Clojure’s rich library for manipulating maps and vectors makes it trivial to transform complex API responses into the simplified “Context” required by LLMs.
3. Cross-Platform Capability: With the mcp-cljc-sdk, developers can write server logic once and deploy it on both the JVM (using clojure.main or GraalVM native images) and Node.js (via ClojureScript), providing flexibility in how the server is hosted and consumed.
Code Sample: Defining a Simple MCP Tool
(defmethod handle-request "tools/call" [request]
(let [{:keys [name arguments]} (:params request)]
(case name
"get-weather" (let [city (:city arguments)]
{:content [{:type "text"
:text (str "The weather in " city " is sunny.")}]})
{:error "Tool not found"})))
Practical Applications and Agentic Workflows
The power of MCP is best demonstrated through real-world “Agentic” use cases. Vedang shares examples of servers he has developed to automate complex tasks. One such server integrates with WhatsApp, allowing an AI agent to scan chat groups for business leads. Instead of a human manually reading hundreds of messages, the agent uses the MCP server to fetch the latest messages, identifies intent, and provides a summarized report of actionable items.
Another significant application is in browser automation. Using an MCP server for Playwright, an AI can navigate the web as a user would—logging into sites, extracting data from dynamically rendered pages, and performing actions. This allows for prompts like “Find me a hotel within walking distance of the reClojure conference,” where the agent autonomously searches maps, checks availability, and compares prices. These examples illustrate how MCP enables the transition from simple chatbots to true “agents” capable of multi-step reasoning and interaction with the physical or digital world.
The Future of Content-Centric AI
Looking ahead, the evolution of MCP suggests a shift toward a “content-is-king” paradigm. Current AI interactions are often limited by the UX of the chat box. However, with MCP, the focus can move toward the actual content being produced or modified—whether that is a codebase, a spreadsheet, or a document. Vedang envisions a future where multiple coding agents can work in parallel on the same repository, coordinated through a “better Git” or similar bidi-rectinal communication protocols enabled by MCP.
By standardizing the way agents interact with our tools, MCP paves the way for a new generation of software that is designed from the ground up to be AI-enhanced. For the Clojure community, this represents a significant opportunity to lead the development of the “AI UX” by building robust, composable servers that unlock the full potential of Large Language Models.