What are Insecure Tool Defaults?

Software defaults matter enormously. Most users never change them. In traditional software, insecure defaults have caused decades of breaches — open database ports, default admin credentials, permissive CORS headers. MCP tools inherit this problem and amplify it.

When an MCP server exposes a file system tool with no path restrictions by default, any connected agent can read /etc/passwd or write to arbitrary locations. When a database tool defaults to full query access, agents can DROP TABLE as easily as SELECT. The tool authors assume operators will configure restrictions — but in practice, many deployments run with defaults.

The problem is compounded by AI agents. A human developer might notice that a tool has dangerous defaults and configure restrictions. An agent does not exercise this judgement — it uses whatever capabilities are available. If the file system tool allows writes, the agent will write when it deems appropriate. The agent optimises for task completion, not security.

This creates a systemic risk: as the MCP ecosystem grows and developers install tools from registries, the aggregate attack surface of unconfigured defaults expands. Each insecure default is a potential entry point for prompt injection, data exfiltration, or privilege escalation.

Intercept provides a security layer that is independent of individual tool defaults. Even if an MCP server ships with unrestricted file access, Intercept's YAML policies can constrain which paths are accessible, which operations are permitted, and what argument values are allowed. This means organisations do not rely on every tool author making secure choices — Intercept enforces the organisation's own security posture regardless of upstream defaults. The fail-closed design ensures that tools without explicit policy rules are denied by default.