MCP security overview

MCP security is about controlling what an AI client can do through a server. The main surfaces are authentication (who can connect), tool permissions (what a tool can do), and data handling (secrets, PII, and prompt injection). Least privilege is the core principle: grant the minimum access a task requires.

The primary risk is that an AI agent operating through tools performs an action its operator did not intend. Secondary risks include malicious or compromised servers, prompt injection steering the agent, credential leakage, and overly broad tool access.

Remote servers must authenticate callers. Bearer tokens and OAuth are the common mechanisms. Authorization decides which caller may invoke which tool. Separating authentication from authorization keeps control proportional.

Grant tools the minimum capability required. Prefer read-only servers for AI-agent callers. Treat any write-capable tool as a high-risk surface and review it before enabling.

Prompt injection is content that tries to subvert the agent's instructions; it is mitigated at the host and model layer. Secrets should never appear in tool arguments or logs. Keep PII out of request and response trails.