The Identity You Didn't Know You Granted: How MCP Quietly Breaks Per-User RBAC in LLM-Powered SOC Tools

Everyone's bolting LLMs onto their security stack right now — "just ask your logs a question in plain English." We wanted to actually build that, so we did: queryCopilot, an open-source Kibana plugin that takes an analyst's question, turns it into a real KQL query, and runs it against Elasticsearch. It uses MCP — the protocol everyone's adopting to give models access to data — for live query execution.

Then we did the thing people skip: we tried to break our own tool. And the scariest bug wasn't some exotic AI thing. It was plumbing. When a query runs through an MCP server, that server talks to Elasticsearch as one fixed identity — but Kibana decides who-can-see-what per user. So the second an analyst's query goes through MCP, your per-user permissions just… stop mattering. Everyone effectively gets the container's access. We can show it live: a low-privilege analyst pulling logs they should never be allowed to see.

There's more. An internal endpoint we assumed was admin-only is actually wide open to anyone logged in, because the permission it claims to require was never registered with the platform — so the check does nothing. And we'll show a log line with "ignore previous instructions" hidden inside it reaching the model — and why, this time, it doesn't break anything.

We're not going to just stand there and dunk on our own code, though. For every problem we'll show the fix, and you'll leave with a checklist you can run against whatever AI tooling you're building. The honest punchline: the part we were most scared of — handling people's API keys — turned out fine. The real holes were in the boring stuff. Auth. Identity. Input. They always are.

If you're putting an LLM anywhere near your security data, this is the trust boundary nobody's talking about yet.

• A trust boundary to check in your own stack: when an MCP server — or any service account — executes queries, it runs as one fixed identity, and silently bypasses the per-user RBAC your platform thinks it's enforcing.

• A bug class that's easy to ship and hard to see: an authorization tag that's declared but never registered is a silent no-op, leaving "admin-only" routes open to any authenticated user. We'll show how to verify enforcement, not just annotation.

• Why validation that checks length isn't validation that bounds risk — and what an index-pattern filter actually has to reject (system indices, cross-cluster targets) before it's safe.

• How attacker-controlled log data turns into prompt injection — and the design that keeps it contained: a validated output contract that still executes under the caller's permissions.

• A reusable checklist for handling user-supplied API keys safely — log scrubbing, no client exposure, no browser persistence, encryption at rest — plus the reminder that the real holes sit in auth, identity, and input bounds, not the AI.