MCP Security for Insurance Claims AI Agents

Why MCP Changes the Claims AI Attack Surface

Model Context Protocol lets an agent discover and call external tools at runtime instead of following a fixed integration path. That flexibility is also what creates a new class of risk: the tools an agent might invoke, and the order it invokes them in, are not fully known in advance. The overview below summarizes the risk surface before the detailed breakdown that follows.

Three MCP-Specific Risk Categories in Claims Processing

• Tool Poisoning: A compromised or misleading tool manifest can change how an agent behaves or what it outputs, even though the agent's model itself is unmodified. This risk is difficult to detect through model testing alone.
• Unauthorized Tool Invocation: When an agent's access to tools is broader than a given claims task requires, and no per-call authorization check exists, the agent can invoke tools outside its intended workflow scope.
• Data Exposure Through Tool Chains: Claims workflows often pass policy, medical, or claimant data through multiple intermediate tool calls. Without consistent data classification and redaction at each step, sensitive data can surface in places it was not intended to reach.

Runtime Architecture Controls That Address MCP Risk

1. 1

   Workflow-Stage Segmentation

   Separating tool access by claims stage, such as intake, adjudication, and payment, limits the blast radius if a single tool integration is compromised.

2. 2

   Per-Tool, Per-Session Authorization

   Scoping authentication to individual tools and sessions, rather than relying on one agent-level credential, reduces the risk of over-broad access.

3. 3

   Output Validation

   Validating tool responses before an agent acts on them reduces the chance that unvetted external data directly drives a claims decision.

4. 4

   Session-Level Logging and Tracing

   Recording tool calls and their inputs and outputs supports forensic review and produces documentation usable in a regulatory inquiry.

5. 5

   Isolation of External Tool Servers

   Keeping third-party or externally hosted MCP tool servers separate from core claims systems limits exposure if a tool provider is compromised.

Questions CISOs Should Be Able to Answer

• What MCP tools or connectors currently have access to claims data, and who approved that access?
• Can we detect and log an agent invoking a tool outside its intended workflow scope in real time?
• How would we demonstrate to a regulator that our AI governance program accounts for agentic tool-use risk, not just model risk?
• What is our process for vetting or updating third-party tool manifests before they reach production claims agents?
• If a tool integration is compromised, what is our contained blast radius and incident response path?

Mapping Runtime Controls to NAIC Model Bulletin Expectations

The NAIC Summer National Meeting, held August 11 through 14, 2025 in Columbus, Ohio, brings continued regulatory attention to how insurers govern AI systems. State adoptions of the NAIC Model Bulletin on the use of AI systems generally reflect an expectation that insurers document oversight of AI-related risk, though the exact bulletin language and any AI-specific agenda items from this meeting should be verified against primary sources before being cited as settled requirements.

What is clear from the structure of agentic systems themselves is that model-level governance, such as documenting how a model was trained or tested, does not capture how that model behaves once it is calling external tools at runtime. CISOs should expect that demonstrating governance will increasingly require evidence at the tool-interaction level: who approved a given tool's access to claims data, what authorization scope applies to each call, and how anomalous invocation would be detected and logged.

Insurers should treat this as an extension of existing AI governance programs, mapping risk assessment, testing, monitoring, and documentation practices onto the agent-tool attack surface rather than assuming current controls already cover it.