MCP 2.0 Explained: Securing AI Agents Before They Secure Themselves

Note: “MCP 2.0” is used here as a colloquial reference to the next-generation evolution of the Model Context Protocol. MCP itself uses date-based versioning (e.g., the latest release being 2025-11-25 at the time of this document’s release) and does not officially define a 2.0 release.

AI agents are no longer just answering questions – they’re taking action. They’re reading files. They’re modifying systems. And in some cases, they’re making decisions that ripple across an entire enterprise.That’s why Model Context Protocol (MCP) 2.0 matters.In a recente puntata di STRIVE, Commvault’s thought leadership series on cyber readiness, I sat down with Werner Nel, Principal, Security and AI Intelligence, at Commvault, to unpack what MCP 2.0 really changes – and why security leaders can’t afford to treat it as a minor spec update.This isn’t a theoretical conversation. It’s a practical look at how enterprises can enable AI innovation without widening their blast radius.

Punti chiave: cosa cambia davvero con MCP 2.0

• MCP 2.0 segna il passaggio dall’adozione dell’intelligenza artificiale alla responsabilità.
• OAuth può consentire un accesso con privilegi minimi agli agenti di intelligenza artificiale.
• Gli schemi strutturati possono contribuire a ridurre il rischio di iniezione di prompt e di abusi.
• I flussi di richiesta possono prevedere punti di pausa fondamentali per le azioni ad alto rischio.
• MCP 2.0 may help improve security – but doesn’t eliminate risk.
• È fondamentale comprendere il concetto di autorità dell’agente e il raggio d’azione.

Perché MCP 2.0 rappresenta una svolta

MCP 1.x was about adoption.It gave enterprises a way to connect AI models to real tools and real data. But as Werner explains, that first wave was never designed to answer the hardest question: How do we let AI agents execute real work inside the enterprise – without turning them into a security liability?

MCP 2.0 is the industry’s first serious attempt to answer that question.Instead of focusing purely on connectivity, it shifts attention to authorization, control, and visibility – three things security teams care deeply about, especially as agents move from read-only assistants to actors with real power.

I tre cambiamenti fondamentali in materia di sicurezza

1. OAuth comes to MCP. MCP 2.0 introduces OAuth support, giving enterprises a standardized way to assign permissions and enforce least privilege. Instead of relying on vague trust assumptions, agents can be scoped to exactly what they’re allowed to do—and nothing more.
2. Structured schemas help reduce prompt injection risk. Structured schemas act like an allowlist for agent actions. If a tool isn’t explicitly defined in the schema, it won’t execute. This can help reduce prompt injection risk and other manipulation techniques that were easier to exploit in earlier implementations.
3. Elicitation flows add a “pause button.” Elicitation flows can enable workflows to pause mid-execution so a high-risk step may trigger confirmation, validation, or even credential escalation. This can help shift teams from “log and hope” to more deliberate control over sensitive actions.

Anteprima: MCP 2.0 in azione

Questa anteprima mette in evidenza perché l’autorità, il raggio d’azione e la reversibilità sono le tre questioni più importanti che le aziende dovrebbero porsi quando implementano agenti di IA.

The Gaps MCP 2.0 Doesn’t Solve (And Why That’s Important)

MCP 2.0 is a big step forward – but it’s not the finish line. As Werner highlights in STRIVE, there are still meaningful gaps enterprises need to account for in real-world deployments.For example, enterprises still can’t fully cryptographically prove that an MCP server is the authentic original (vs. a clone or modified copy). Similarly, even if the protocol improves authorization and input discipline, organizations still need to think about signing tools and binaries, and about the environment where MCP servers and models run – because a compromise can translate into broad access depending on how it’s deployed.The takeaway: MCP 2.0 improves the protocol, but organizations still have to make smart decisions about trust, containment, monitoring, and oversight.

Un semplice quadro di riferimento per la valutazione del rischio degli agenti di intelligenza artificiale

One of the most practical moments in the episode is Werner’s three-question risk lens – something CISOs and architects can apply immediately:

• Quali sono i poteri del mio agente?
• Qual è l’ampiezza del raggio d’azione dell’esplosione?
• In che misura le misure adottate sono reversibili?

These questions help teams move from generic “AI risk” discussions to concrete decisions about permissions, containment, and how to handle high-impact actions that may not be easy to roll back.

Guarda l’episodio completo di STRIVE

This blog only scratches the surface. In the full 20-minute STRIVE podcast, you’ll hear:

• Perché MCP 2.0 si è evoluto così rapidamente.
• Quali dovrebbero essere le priorità dei CISO in questo momento.
• Quale potrebbe essere il futuro di MCP 3.0.
• Come i team di sicurezza possono stare al passo con l’aumentare dell’autonomia degli agenti.

Guarda l’episodio completo di STRIVE su Readiverse.Approfondisci la questione e valuta il tuo grado di preparazione.

Domande frequenti

Q: What is MCP 2.0?

A: MCP 2.0 is an updated protocol that governs how AI models interact with enterprise tools and data, with a strong focus on security, authorization, and control.Q: How is MCP 2.0 different from MCP 1.x?

A: MCP 1.x focused on connectivity and onboarding. MCP 2.0 prioritizes securing those interactions.Q: Does MCP 2.0 eliminate AI security risk?

A: No. It can help improve security hygiene but must be paired with strong architecture and governance.Q: What is an elicitation flow?

A: An elicitation flow allows AI workflows to pause for confirmation before executing high-risk actions.Chris Mierzwa è direttore senior del reparto Portfolio Marketing presso Commvault.

Blog correlati

• La frontiera causale: colmare il divario tra intelligenza e resilienza
• Arlie’s Latest Enhancements: Your New and Improved AI Assistant
• A CIO’s Perspective: Strengthening Business Resilience in the AI Era
• Data Activate: Sfruttare il potenziale dei dati affidabili per l’innovazione nell’IA