Monitoring configuration and automating detection & remediation for MCP

Key Concepts

• Security Command Center (SEC): Google Cloud’s central platform for AI security management and auditing.
• AI Agents: Autonomous entities leveraging models to perform tasks.
• Model Armor: A runtime security layer inspecting data for malicious content.
• MCP (Model Composition Platform) Servers: Servers hosting models used by agents.
• Posture Management: Continuous monitoring of infrastructure for misconfigurations and vulnerabilities.
• Customer Managed Encryption Keys (CMEK): Encryption keys managed by the customer for enhanced data security.
• Sensitive Data Protection (SDP) Discovery: Scanning for exposed secrets like API keys.
• Secret Manager: A secure service for storing and managing sensitive information.
• Prompt Injection: A threat vector where malicious input manipulates the agent’s behavior.

AI Security with Google Cloud Security Command Center

This presentation details how Google Cloud’s Security Command Center (SEC) provides a comprehensive security solution for AI agents and their underlying infrastructure. Securing agents is presented not as a one-time setup, but as a continuous process managed centrally through SEC, leveraging built-in AI protection. SEC functions as a single dashboard for managing AI-related risks, vulnerabilities, and threats.

AI Asset Discovery and Inventory Management

SEC utilizes automated discovery to create a unified inventory of AI assets. This includes models, data sets, agents, and MCP servers. This inventory provides visibility into model and data usage, connections within the agent ecosystem, and potential associated risks and misconfigurations. Understanding these connections is crucial for identifying potential attack vectors.

Posture Management and Vulnerability Detection

SEC’s posture management feature continuously monitors the infrastructure hosting agents and MCP servers for misconfigurations. Specifically, it detects vulnerabilities in MCP servers that could expose tools to compromise. A key finding highlighted is the identification of instances where Foundation models or Vertex AI endpoints are not secured by Model Armor. This is critical because Model Armor inspects data returned from MCP servers for malicious content before it reaches the model, preventing potential harm.

Runtime findings from Model Armor – including direct jailbreak attempts, indirect injections, and detection of poisonous data at the MCP tool level – are centralized within SEC, providing summary statistics for detected issues.

Agent Observability and Logging

The presentation emphasizes the need for observability into agent actions to ensure alignment with intended behavior. Comprehensive logging of all agent actions is recommended, capturing the agent ID, session ID, and payload details. This detailed logging facilitates auditing and reconstruction of agent activities, enabling verification of actions taken with associated tools and clients.

Identity and Access Management (IAM) & Compliance Monitoring

SEC verifies that agents maintain only the minimum necessary permissions, adhering to the principle of least privilege. Furthermore, SEC monitors compliance with platform security controls, citing Customer Managed Encryption Keys (CMEK) for Vertex AI assets (models and datasets) as an example. A link to further information on CMEK is provided in the video description.

Actionable Remediation and Prioritization

SEC doesn’t just identify issues; it provides actionable guidance for remediation. The dashboard highlights “choke points” – infrastructure weaknesses impacting multiple connected assets. The example given demonstrates fixing a single firewall protection, which instantly secures all downstream MCP servers and other AI assets.

SEC maps identified MCP security risks to specific Google Cloud controls, such as IAM and Model Armor, enabling prioritization of fixes based on impact.

Proactive Security Measures: Sensitive Data Protection

The presentation advocates for proactive security measures, specifically utilizing Sensitive Data Protection (SDP) discovery to periodically scan MCP servers for hard-coded secrets like API keys exposed in build and runtime environment variables. Upon discovery, the recommendation is to rotate these secrets and store them securely using Secret Manager. Links to a step-by-step lab on SDP and a deep dive video on using Secret Manager for agentic workflows are provided.

Series Context and Further Learning

This presentation is part three of a series on MCP security. Part one covered the core MCP architecture, expanded attack surface, and threat vectors like prompt injection. Part two demonstrated secure patterns for identity, network isolation, and runtime protection. Viewers are encouraged to watch the previous videos (links provided) and to suggest future topics in the comments.

Quote: “Security Command Center gives visibility into your AI inventory, detecting active runtime threats, and providing actionable steps to fix vulnerabilities.” – Presenter.