The highest-yield question in a cloud assessment is short: who can reach this? Applied to MCP servers, it usually has an uncomfortable answer — anything inside the VPC, because nobody designed it.
Two directions, two different problems
Segmentation for agents is not only about controlling who gets in. It is also about controlling where the process can go, and the second direction is the one almost everyone forgets.
Ingress: who can invoke tools. If the answer is “any pod in the cluster”, a compromise of any other service becomes action execution with the agent's credentials.
Egress: where the process can reach. Egress is what turns SSRF into credential theft, prompt injection into exfiltration, and a third-party server into a command channel. Controlling it is more work and pays more.
A design that works
- Dedicated namespace or subnet for agent workloads. No cohabiting with business applications.
- Default deny in both directions. In Kubernetes, a NetworkPolicy with no egress rules already denies everything; open destinations one at a time.
- Explicit block on the metadata endpoint from any process that accepts untrusted input.
- Egress proxy with a domain allowlist for tools that genuinely need the internet. That proxy's log is, in practice, the best anomalous-agent-behaviour detector you will get for free.
- Internal MCP servers bound to loopback or a dedicated network, never 0.0.0.0.
The third-party server case
A third-party MCP server deserves vendor treatment, not plugin treatment. Trend Micro reported CVSS 9.8 command-injection flaws in unofficial AWS and Azure MCP servers — exactly the kind of component someone installs because the name looked official.
If a component executes actions with your credentials, it is a critical vendor. Having been installed with one command does not change that.
The side benefit
Good segmentation gives you something no scanner does: it shrinks the blast radius of flaws you do not know about yet. With more than 40 CVEs disclosed across four months and a cadence near one every four days, designing for containment is more realistic than designing for complete prevention.
