What is an MCP Security?

Because MCP gives a connected server the ability to describe tools that a model may then be induced to call, the core threat model is different from a typical API integration: the attacker doesn't need to breach your server, just word a tool description or a piece of returned data cleverly enough to manipulate the model into taking an unintended action, a class of attack often called tool-poisoning or prompt injection. Sound MCP security practice starts with never treating a server's declared tool descriptions or returned resource content as trusted instructions, and always requiring explicit user or policy approval before a tool call with real-world side effects executes. On the transport side, security means proper OAuth-scoped authorization rather than static shared secrets, TLS for any network transport, and least-privilege scoping so a connected server only receives the permissions its declared use case requires. On the host side, it means sandboxing tool execution, rate-limiting and auditing calls, and maintaining a registry of vetted servers rather than connecting to arbitrary untrusted endpoints. Because MCP is young and rapidly evolving, security guidance is still maturing; the safest posture is defense in depth — least privilege, human approval on consequential actions, sandboxed execution, and monitoring — rather than relying on any single control.