MCP Security: Threats, Trust & Best Practices

Security Model & Threats

By DevShelfHub

MCP gives servers significant power — arbitrary tool execution, data access, sampling. That makes its trust model the single most important design constraint. Every implementer must understand the attack surface.

Series progress14 / 23

Four principles

User consent and control. Users must explicitly approve every data access and operation.
Data privacy. Hosts must obtain explicit consent before exposing user data to servers.
Tool safety. Tools = arbitrary code. Approval gates are mandatory.
LLM sampling controls. Users must approve sampling. The protocol intentionally limits server visibility into prompts.

Trust boundaries

Host

Fully trusted. Enforces all policy and consent.

Client

Tied to a single server. Cannot see other clients' data.

Server

Untrusted by default. Sees only what the host hands it.

Major attack vectors

Confused Deputy

A server tricked into performing actions on behalf of an unauthorised caller. Mitigation: validate the authorization context on every request; never trust the caller's "user_id" parameter.

Server-Side Request Forgery (SSRF)

A tool that fetches a user-supplied URL gets pointed at internal infrastructure (http://169.254.169.254/, internal LANs). Mitigation: allow-list schemes, block RFC 1918 ranges, use a forwarding proxy.

Token Theft

Stolen access tokens used to impersonate clients. Mitigation: short lifetimes, HTTPS-only, token binding, refresh-token rotation.

Malicious OAuth Proxy

A proxy injected into the OAuth flow skips user consent. Mitigation: per-client consent runs before any third-party authorization redirect.

Local Server Compromise

A compromised local server pivots to access other resources on disk. Mitigation: per-server process isolation, capability-based filesystem scoping (Roots are NOT enough).

Prompt Injection & Data Exfiltration

A malicious resource embeds instructions that hijack the LLM. Mitigation: sanitise resource bytes, surface model-generated tool calls to the user, scope sampling context (includeContext).

Implementer checklist (SHOULD)

Robust consent UI with clear server identity
HTTPS-only transports outside development
Token scoping and short access-token lifetimes
Allow-list resource URI schemes
Rate-limiting on sampling, elicitation, task ops, completions
Per-server process isolation for local servers
Validate server authenticity (SEP-1024)

Quick summary

Trust flows host → client → server, never the other way
Confused deputy, SSRF, token theft, malicious proxy, local compromise — the five threats to design for
Roots are advisory; enforce filesystem scoping in the host
Treat every tool call as code execution; require user approval

MCP Security FAQ

What is the MCP trust model?

In MCP, the Host is the trust boundary. Hosts should verify the identity of servers they connect to, display tool calls to users for approval, and sandbox server capabilities. Servers are considered less trusted than the host by default.

What is prompt injection in MCP?

Prompt injection occurs when malicious content in tool results or resource data tricks the AI model into taking unintended actions — like exfiltrating data or calling destructive tools. Mitigations include sandboxing tool outputs and using tool annotations to flag sensitive tools.

What is a confused deputy attack in MCP?

A confused deputy attack happens when a legitimate MCP server is tricked into acting on behalf of a malicious client — for example, accessing resources or calling tools outside the scope the user intended. Proper capability scoping and user consent flows mitigate this.

How can MCP servers prevent SSRF attacks?

Server-Side Request Forgery (SSRF) occurs when an MCP server fetches URLs provided by an attacker, potentially hitting internal services. Mitigations include allowlisting permitted domains, blocking RFC 1918 addresses, and validating all user-supplied URLs before fetching.

What are MCP tool poisoning attacks?

Tool poisoning is when a malicious MCP server exposes tools with misleading descriptions designed to trick the AI model into calling them inappropriately. Hosts should only connect to trusted servers, and tools with destructiveHint annotations should always require explicit user approval.