Celigo MCP Server Security: What It Blocks, What It Doesn't

Security teams are right to be wary of connecting AI agents to real business systems. Every tool an agent can call widens what an attacker can reach through it, and security researchers have spent 2026 documenting exactly how: prompt injection (instructions hidden in content the AI reads) and tool poisoning (instructions hidden in a tool's own description). If you're deciding whether to let an AI assistant query NetSuite through Celigo's MCP Server, the useful question isn't "is MCP safe?" — it's "which of these risks does Celigo's layer close, and which ones are still mine to design around?"

What Celigo's MCP layer closes by design

A direct AI-to-NetSuite connection puts API credentials into the model's context, prompts and logs, lets the AI do anything those credentials allow, and leaves no audit trail. Celigo's MCP Server — covered in detail in our MCP Server overview — removes each of those by construction:

• No credentials in the model. The AI client authenticates with a scoped token managed by Celigo. A leaked prompt or log exposes a token you can revoke, not NetSuite access.
• Read-only where you want it. Read-only tokens are enforced at the MCP layer, not by an instruction in the prompt — so even a fully manipulated model can't create, edit or delete records.
• Only the tools you defined. Tools are built in Celigo with fixed inputs and outputs. The AI can call "order status by order number"; it can't improvise a query you never exposed.
• Logged and rate-limited. Every call is recorded with who made it and what it asked, and rate limits stop a misbehaving client from hammering NetSuite.

That's most of what our AI agent governance article calls identity, access control and monitoring. What's left are attacks that work through a correctly authenticated, correctly scoped connection.

What it doesn't close on its own

Prompt injection hidden in ERP data

The MCP Server returns what's in NetSuite, faithfully. If a customer memo, an item description or a vendor note contains text like "ignore your previous instructions and…", the AI client reads it as part of the answer — and the model decides what to do with it. Celigo can't tell an innocent memo from a malicious one; nothing at the transport layer can. Microsoft's developer guidance on MCP covers this under the name indirect prompt injection.

Data leaving through other tools on the same assistant

Read-only stops the AI from changing NetSuite. It doesn't stop the AI from repeating what it read somewhere else. If the same assistant also has an email tool, a web-fetch tool or a chat integration, an injected instruction can turn "look up this customer's balance" into "look it up and send it out." The leak happens in the AI client, entirely outside Celigo.

Tool poisoning from servers you don't control

Tools you build in Celigo are under your control. A third-party MCP server added to the same AI client is not — and its tool descriptions are read by the same model that holds your ERP data. A poisoned description from one server can steer how the model uses another.

Tools that are wider than the question

Scoping only works if the tools are narrow. A tool like "run any saved search" or "return the full customer record" quietly hands back most of what the token restrictions were meant to withhold — including the free-text fields where injected instructions live.

The design choices that close the gap

• One question per tool. "Inventory by SKU" returning quantity and location, not "item lookup" returning everything. Fewer fields returned means less room for hidden instructions and less to leak.
• Leave free-text fields out unless the question needs them. Memos, notes and descriptions are where injected text lives. Numbers, dates and statuses are safe to return; prose is a decision.
• Keep ERP access off assistants with outbound tools — or require a person to approve anything that assistant sends, posts or emails.
• Don't mix servers casually. An assistant that queries NetSuite shouldn't also load arbitrary third-party MCP servers.
• One token per AI client. Then every line in Celigo's query log points to a single assistant, and revoking one doesn't break the others.
• Actually read the log. A weekly look at query volume and unusual parameters catches misuse that no single call would flag.

Frequently Asked Questions

Is Celigo's MCP Server secure enough to connect an AI assistant to NetSuite? It removes the biggest risks of a direct connection — no credentials in the model, read-only enforcement, every query logged. Prompt injection in returned data and leaks through other tools on the same assistant depend on how the tools and client are set up.

What is prompt injection in an MCP setup? Instructions hidden in content the AI reads — in an ERP setup, often a free-text field on a record. Narrow tools that return only the fields a question needs shrink the risk.

What is tool poisoning? Malicious instructions in a tool's name or description. The risk mostly comes from third-party MCP servers connected to the same AI client, not from tools you define in Celigo.

Should the AI that queries NetSuite also be able to send email or browse? Not without a human approval step — read access plus an outbound channel is what turns an injection into a data leak.

Entech Solutions builds governed AI access to NetSuite and Salesforce on Celigo, including the tool design and client setup that decide how exposed you actually are. See our AI Agents & MCP page, or get in touch to review a planned setup before it goes live.

Further reading: Microsoft — Protecting against indirect prompt injection attacks in MCP; Cloud Security Alliance — Agentic MCP Security Best Practices.