MCP is secure enough for enterprise production only when it is governed above the protocol. The MCP specification requires OAuth 2.1, PKCE, Resource Indicators (RFC 8707), issuer validation, and token-audience binding, and it names the confused-deputy problem. A peer-reviewed 2026 study identified tool poisoning as a prevalent client-side attack; CVE-2025-49596 exposed remote-code-execution risk in MCP Inspector; and CVE-2026-44192 showed how indirect prompt injection could lead to unauthorized file writes and command execution in an MCP server. Production safety requires validating tool metadata, scoping tokens to a single audience, requiring human approval for consequential writes, logging every action, and keeping MCP tooling patched. A governance control plane applies those controls once at the execution layer.