Within twelve months, MCP went from open specification to default connection layer for AI agents. Anthropic published the standard in November 2024. By December 2025, Anthropic counted more than 10,000 active public MCP servers, with deployment support from AWS, Google Cloud, and Azure. ChatGPT, Gemini, Microsoft Copilot, Cursor, and Visual Studio Code all use it. That adoption speed is rare even in a sector used to fast cycles around LLMs.

A standard that outgrew its controls

The growth is not accidental. MCP solves a real problem: it lets agents and coding assistants use a single interface to connect to multiple tools and data sources, avoiding custom connectors. But that standardization has shifted the risk. Security teams previously focused on the model and on the credentials of individual integrations. Now they have to guard an intermediate layer that mediates between the agent and external systems.

The issue is not the network. The threats described by OWASP show that the weakness lives in metadata and tool descriptions. Tool poisoning takes prompt injection to the next level: malicious instructions are embedded in tool descriptions, schemas, or return values to manipulate agent behavior. Rug pull attacks are even more insidious: an attacker changes a tool's definition after a human has already approved it, exploiting the trust created by that approval. Tool shadowing and cross-origin escalation use a malicious server's tool description to alter how an agent uses tools belonging to a trusted server.

The figures cited by the source reinforce the picture: an analysis by Lakera, the AI security company Check Point acquired in 2025, examined 10,000 MCP servers and found exploitable weaknesses in 40% of them. This is not a set of theoretical vulnerabilities. It is a surface that combines ready-to-use code, automation, and access to sensitive data.

The threat lives in metadata, not packets

That is the difference from traditional firewalls. A network firewall sees connections, signatures, and volumes. Tool poisoning travels inside a semantically normal response: the agent receives an instruction, not malware. Data exfiltration can happen by inserting sensitive information into otherwise legitimate tool calls, such as searches or email sends. Over-permission is another vector: an MCP server with broader permissions than the task requires increases exposure. In all these cases, the traffic can look regular.

Check Point presented its answer in July 2026 with AI Network Firewall, a product that fits into customers' existing firewall infrastructure. It discovers MCP servers, inspects MCP traffic, and enforces policies on agent access. TrueFoundry takes a different approach with AI Gateway, focused on governance, access control, and auditing of interactions between MCP tools and agents. Cisco has extended AI Defense with agent-facing guardrails, MCP scanning, and real-time inspection of MCP traffic. The term "AI firewall" actually covers two meanings: AI-powered firewalls against conventional threats, and firewalls built to defend AI itself. The products cited belong to the second category.

The perimeter shifts: whoever controls the connector wins

The competition among vendors is not just about features. It is a contest over where the trust control point should live: on the network, on the tool infrastructure, or on the agent. Whoever controls the MCP connector also controls visibility into what an agent can actually do. That explains why Check Point bets on the network firewall, TrueFoundry on the gateway, and Cisco on the agent. These are not interchangeable answers.

For teams running self-hosted systems, the stakes are higher. A local MCP server reduces dependence on external services but creates an internal bridge to databases, file systems, and applications. If the agent gets broad permissions on that server, a poisoned description can turn a normal search operation into an exit channel for sensitive data. In a data sovereignty context, the problem is not only the public server: it is also the trust placed in tool descriptions running inside the perimeter.

MCP security is not the same as agent security. Agents can reach tools and data without using MCP at all. Securing the connectors helps reduce tool poisoning, unauthorized access, and data loss, but it is not enough. Teams need a mix of controls: signed and pinned tool versions, least privilege, call auditing, and integration with the existing security stack. For those evaluating on-premises deployment, AI-RADAR offers analytical frameworks at /llm-onpremise to compare these trade-offs.

The final question is not whether a specialized firewall is useful. It is whether it will see the threat before the agent has already turned it into a perfectly legitimate call.