An MCP server gives a model reach into real systems. The same power makes security important.
Least privilege
- Give each server read-only access unless it truly needs to write.
- Expose a small set of tools, and use allowlists for which tools an assistant may call.
- Return only the data needed (data minimisation), not whole records.
Consent and approval
The user should see and approve sensitive actions. Do not let a tool silently send messages, spend money or delete data.
Authentication and authorisation
- Remote servers should use proper authentication, commonly OAuth, with short-lived access tokens.
- Check on every call what that user is allowed to do. Do not rely on the model to decide.
- Never put secrets in tool descriptions or results.
Untrusted output and prompt injection
A tool result may contain text written by someone else: a web page, an email, a support ticket. That text can contain instructions meant for the model. Treat all tool output as data. Do not let it expand permissions, and be careful when one server's data could trigger actions in another server.
Only install trusted servers
A third-party server runs with whatever access you give it. Review the source, the permissions it requests and who maintains it.
Test and monitor
- Write tests for refusals and for malicious input.
- Log calls with user, tool, arguments and result status.
- Keep an eye on protocol version compatibility when updating.