AI Security
MCP Server Security: Securing AI Tools, Connectors, and Permissions
How to keep AI agents useful without giving tools, connectors, and credentials more authority than they need.
Model Context Protocol (MCP) can connect AI assistants to valuable systems. This guide explains how to establish trust, apply least privilege, validate tool requests, and preserve auditability before an agent takes action.
Table of Contents
- Why MCP changes the security boundary
- The trust model for tools and tokens
- A safe workflow example
- How to assess an MCP integration
- Risk rating
- Defensible MCP controls
Why MCP Changes the Security Boundary
Model Context Protocol can connect an AI application to tools, resources, prompts, and downstream services. That can remove friction from useful work, but it also means model output may influence requests that read data, create records, or change a business workflow.
The model must never be the final authority for a sensitive action. Tool access, resource access, and business rules need independent enforcement by the MCP server and the downstream service.
The Trust Model for Tools and Tokens
Treat user input, retrieved documents, tool descriptions, remote metadata, and model output as potentially untrusted. A clear-looking instruction is not evidence that an action is allowed.
Each request needs an accountable identity, narrowly defined permissions, validated parameters, and a server-side authorization decision. A token that is valid for another system should not automatically be accepted by an MCP server or passed to a downstream API.
Verified user intent -> application policy -> MCP client -> MCP server -> downstream API
| | |
confirmation input checks token + action checksA Safe Workflow Example
Consider a support assistant that can search approved knowledge, read a customer case, and create a draft follow-up. An untrusted ticket may contain text attempting to redirect the assistant toward a different account or an unapproved action.
A secure design allows the assistant to summarize the case, but the service verifies the customer scope, permits only a draft action, and requires a confirmed user choice before anything is sent. The document never gains authority merely because the model read it.
How to Assess an MCP Integration
- Inventory every MCP server, transport, tool, resource, downstream API, owner, and data classification.
- Verify that each tool has a narrow purpose, an explicit schema, input validation, and a separate authorization decision.
- Review token audience validation, scope design, consent, redirect handling, session handling, and token storage.
- Test with synthetic data to confirm that untrusted content cannot broaden a tool request, cross a tenant boundary, or bypass confirmation.
- Review local MCP servers as supply-chain components: source, command execution, filesystem access, and network access all matter.
- Confirm that logs capture the requesting identity, tool, policy decision, confirmation, and result without retaining secrets.
Risk Rating
| Severity | Description |
|---|---|
| Critical | Broadly privileged tools can alter cloud, financial, customer, or administrative systems without independent authorization. |
| High | Improper token handling, excessive scopes, or weak tool controls expose sensitive data or permit unauthorized workflow changes. |
| Medium | Unsafe metadata discovery, unvalidated parameters, or weak logging create a limited but meaningful path to misuse. |
| Low | A non-sensitive tool produces misleading output without exposing data or affecting a business process. |
Defensible MCP Controls
- Accept only access tokens explicitly issued for the MCP server; do not use token passthrough as a shortcut.
- Use least-privilege, purpose-specific scopes and elevate access only when a verified action requires it.
- Validate tool parameters and authorize every sensitive action at the server or downstream service.
- Require explicit confirmation for sending, deleting, publishing, transferring, or changing access.
- Restrict outbound network access and validate remote metadata and redirect targets.
- Run local servers with minimal filesystem, network, and operating-system permissions.
MCP Server Security Checklist
- Every MCP server, tool, owner, data source, and downstream dependency is inventoried.
- Server-side authorization verifies identity, scope, tenant, object, and business action.
- Tokens are audience-restricted and are never passed through to unrelated services.
- High-impact actions require explicit user confirmation and durable audit evidence.
- Local MCP servers are trusted, reviewed, sandboxed, and launched with minimal privileges.
- Security testing includes indirect prompt injection, tool misuse, tenant isolation, and logging validation.