Mcp server security

mcp-server-security

MCP security is not ordinary API security: the caller is a manipulable LLM, the server's own metadata is executable-ish content in someone else's context, and agents retry, parallelize, and obey instructions found in data. This skill encodes the attack classes documented in real disclosures and the defenses that counter them. Auth mechanics (OAuth, audiences, tokens) live in mcp-server-auth; this skill assumes identity exists and hardens everything else.

When NOT to use

• Implementing OAuth/discovery/token validation → mcp-server-auth.
• Building the server / transport wiring → mcp-server-implementation (the Origin/localhost/session-ID floors are set there; this skill explains the attacks behind them).
• Generic web/infra scanning, container CVEs, non-MCP pentesting.

Workflow

1. Threat-model against the MCP taxonomy

Walk references/threats.md (each attack: mechanism, real incident, defenses). Summary table:

Attack	One-line mechanism	Canonical defense
Tool poisoning	hostile instructions in descriptions/schema fields the user never sees	pin + hash descriptions; scan in CI; client-side re-approval
Rug pull	benign tool swapped post-approval via list_changed	version-pin servers; alert on description drift
Injection via tool results	fetched/user content carries instructions the model obeys	delimit + sanitize all external content; treat output as untrusted input
Confused deputy	server's own credential exercised on behalf of the wrong caller	per-client consent; audience validation (see mcp-server-auth)
Session hijacking	guessable/replayed session IDs	crypto-random IDs bound to user identity; sessions never = auth
SSRF	tool or discovery fetches attacker-chosen URLs	scheme/host allowlists; block private + metadata ranges pre-fetch
Command injection	tool args reaching a shell / stdio params executed	no shell-out with user input; safe APIs; treat local servers as code execution
Supply chain	malicious/compromised server package	pin versions; review; sandbox; registries don't vet for you
Denial of wallet	unbounded expensive calls (OWASP LLM10)	per-identity quotas, cost caps, retry-after

2. Guardrails in code, not prompts

Test: if the system prompt were deleted, would the constraint still hold? Amount caps, tenancy checks, jurisdiction rules, "never delete without confirmation" — all if + refuse in the handler, never instructions in a description. Make reads easy, writes expensive:

• Destructive tools: explicit confirmation gate (elicitation where supported, or a two-step confirm token), honest destructiveHint, separate write scope.
• Idempotency keys on every mutating tool — agents retry by design; store (caller, key) with a TTL, return the original result on replay.
• Validate inputs at two layers: schema at the protocol boundary, business rules in the handler (path traversal: resolve + verify inside root; never interpolate into SQL/shell).

3. Contain the blast radius

• Run servers sandboxed: container/micro-VM, non-root, read-only FS where possible, minimal egress allowlist. Treat third-party local servers as arbitrary code execution on the host — because stdio servers are exactly that (the SDKs' param-to-shell behavior is documented as by-design).
• Secrets: environment/secret manager only; never in code, client-config args, or logs. Short-lived credentials where the backend allows.
• Per-tool rate limits AND per-identity cost quotas; a kill switch per tool (feature flag/Redis set) that disables it without a redeploy.
• Egress DLP for tools returning records: redact PII/credentials fields the caller's scope doesn't justify.

4. Audit everything, tamper-evidently

One audit event per tool call: caller identity, tool, sanitized args (or a safe summary), outcome, latency, session — to a separate append-only store (SIEM), not the app database. A web-access log is not an audit trail; compliance regimes (SOC 2, HIPAA, PCI) expect attributable, tamper-evident records. Never log tokens or raw secrets. Alert on: guardrail-block spikes, description drift, per-caller cost anomalies, session-length outliers.

5. Sanitize the model-facing surface

• Wrap external/tool-fetched content in explicit delimiters (<external_data source="...">) and screen for injection phrases before returning — code-level, applied unconditionally; neither delimiting nor screening is sufficient alone.
• Never echo unfiltered third-party content into errors or descriptions.
• Annotations are UX hints; clients must not trust them from untrusted servers — never rely on your own annotations as an access control.

6. Gate it in CI

python3 "${CLAUDE_SKILL_DIR}/scripts/security_checklist.py" --repo .

prints the deterministic checklist (pinning, secrets, drift detection, guardrail evals) with PASS/FAIL per item where detectable, TODO where judgment is needed; non-zero exit on failures. Add description-drift scanning (e.g. mcp-scan-class tooling) and a guardrail regression eval (a prohibited action must be refused) to the pipeline — methodology in mcp-server-testing.

Output spec

A hardened server: taxonomy reviewed with written dispositions; destructive tools confirmed + idempotent; two-layer validation; sandboxed runtime with minimal egress; per-tool limits + kill switches; separate audit store wired; external content delimited/sanitized; CI running the checklist + drift detection; secrets and logs clean.

Gotchas

• Stronger models are MORE injectable via tool results, not less — better instruction-following widens this attack. Never reason "the model will ignore it".
• Vet third-party servers like dependencies with hands: review, pin the version, hash the tool descriptions, sandbox. Registries (official one included) do not security-review listings.
• Several defenses are the client's job (consent UI, re-approval on change, sandboxing the server process) — a perfect server still needs a competent host; say so in your security docs.
• Institutional baselines exist — NSA's MCP CSI, OWASP GenAI's secure-MCP guide, CSA's agentic-security practices — cite them to auditors instead of arguing from blogs (index in references/threats.md).
• Real incidents to learn from, not repeat: postmark-mcp (npm server silently BCC'ing mail), CVE-2025-6514 (mcp-remote RCE), CVE-2025-49596 (old Inspector), SSRF-via-discovery in both major SDKs.

Pointers

• references/threats.md — full taxonomy with mechanisms, disclosed incidents/CVEs, defenses, and the institutional-guidance index.
• scripts/security_checklist.py — deterministic CI checklist runner.