MCP security and production hardening
A server is an interface a model drives. Scope it accordingly.
5 min read · Lesson 10 of 10 in this domain
An MCP server exposes capability to something that decides what to invoke probabilistically and may be reading untrusted text while it decides. That framing sets the security posture. Scope access to the minimum the job needs, because the blast radius of a mis-selection is whatever the server can reach. Authenticate at the transport layer — Streamable HTTP supports standard HTTP authentication with OAuth recommended — and never put credentials anywhere the model can see, which includes tool descriptions and prompts. And treat server-declared metadata as a claim rather than a guarantee: a read-only annotation is what the server says about itself, so any policy that skips confirmation must rest on your trust in the vendor, not on the label.
- Scope server access to the minimum required; the blast radius of a wrong tool call is whatever the server can reach.
- Authenticate at the transport layer — Streamable HTTP supports standard HTTP auth, with OAuth the recommended approach.
- Never place credentials in tool descriptions, prompts or any model-visible text; those are read by the model and persist in transcripts.
- Annotations such as a read-only hint are self-reported. Base confirmation-bypass policy on explicit vendor trust.
- A locally running server is not thereby trustworthy — a local process has full access to the machine.
- Treat everything a server returns as untrusted input: tool output can carry injected instructions and must not be followed as commands.
- Gate irreversible actions in the host with confirmation, rather than relying on the server to behave.
Trusting annotations, or treating 'runs locally' as equivalent to 'is safe', are both offered as reasonable and are both wrong.
An MCP server declares a tool read-only. Can you skip confirmation on that basis?
The server chose that label for itself and nothing validates it, so it cannot carry a security guarantee. A local server is no safer — a local process has full machine access.
Where should an MCP server's API credentials never appear?
Model-visible text is read by the model and persists in the transcript, so anything placed there is durably exposed. The other three are all appropriate places for a secret.
Practise this domain with 18%%-weighted questions in the study app.
Open in study appSource: MCP — Architecture overview · Independent study aid, not affiliated with or endorsed by Anthropic.