An MCP server is a security boundary: it gives an AI application a route to tools, data, and external services. Secure it by authenticating and authorizing every caller at the server, limiting each server’s permissions, isolating its execution, reviewing its packages and tool definitions, treating retrieved content as untrusted, validating inputs and outputs, requiring approval for consequential actions, and monitoring calls. The right implementation depends on whether the server runs locally or remotely and which MCP and authorization versions your client and server support.
What makes an MCP server a security boundary?
MCP security is not only a question of whether an endpoint is exposed to the internet. An MCP server presents tools and their descriptions to an AI application, which may choose calls based on natural-language context and that metadata. A risk can therefore enter through the network, local process access, a package update, a poisoned tool description, or untrusted content returned by a tool.
The MCP project’s Security Best Practices and OWASP’s MCP Security Cheat Sheet describe threats including prompt injection, tool poisoning, excessive privileges, confused-deputy behavior, cross-server influence, supply-chain compromise, and local-server exposure. Microsoft’s guidance on indirect prompt injection in MCP likewise warns that malicious content can influence tool use and expose data. These sources establish relevant attack paths and controls; they do not establish an incident rate or prove that any single vendor, gateway, or prompt filter makes an MCP deployment secure.
How to secure an MCP server: a practical control order
- Authenticate callers and authorize at the server. Verify the caller and the requested operation at the enforcement point; do not rely on the model or client to make access-control decisions.
- Minimize access. Give each server and tool only the data, credentials, scopes, and operations needed for its job.
- Isolate execution. Restrict process, filesystem, and network access, especially for local servers.
- Review packages and tool metadata. Know where a server came from, pin and control updates, and inspect changes to tool names, descriptions, schemas, and startup configuration.
- Treat content as untrusted. Retrieved pages, documents, messages, and tool results are data, not instructions with authority to override policy.
- Validate and gate actions. Check arguments and results, and require meaningful approval plus deterministic policy checks for sensitive operations.
- Monitor calls. Keep audit records sufficient to investigate who requested an operation and what the server did, while excluding secrets.
Can an MCP server be prompt-injected?
Yes. Indirect prompt injection can be embedded in content a tool retrieves, such as a webpage, email, or document. Tool poisoning is a related risk: malicious or altered names, descriptions, or metadata can influence an LLM’s choice of tool. A result returned by one tool can also carry hostile instructions into the model’s context. Telling the model to ignore malicious instructions is not a complete control, because the model still processes the content and may choose an unauthorized call.
Recommended Free Tools
#1 Best Overall
Reduce exposure before the model sees the content
- Install only server packages from sources you trust, review their provenance, and control versions and updates.
- Inspect tool names, descriptions, and schemas before enabling a server, then review material changes as you would code changes.
- Limit which tools are available in a task and constrain their arguments to the minimum required.
Enforce policy outside the model
- Authorize every operation against a verified identity and its permissions, even if the model requested it.
- Validate inputs before execution and validate outputs before returning them to the model or user.
- Do not allow content from a tool result to grant permissions, change policy, or silently authorize another action.
How do I prevent an MCP server from exposing data?
Start with least privilege and identity-aware authorization. A server that can read every user’s files or use a broad shared API credential can expose more than the initiating user is entitled to see. OWASP’s MCP Security Cheat Sheet discusses excessive OAuth scopes, legitimate tool channels used for exfiltration, and confused-deputy behavior: a server or proxy uses its own broader privileges in response to a caller who lacks those privileges.
Keep the caller’s authority intact
- Use narrow scopes and separate credentials for servers or tasks instead of one reusable, broad credential.
- Preserve the user’s identity and consent context through the operation. Check that the verified principal is allowed to perform the particular action on the particular data.
- For a server calling an upstream API, obtain and use the appropriate upstream credential. Do not pass the MCP client’s access token through to that API.
- Where a proxy or shared OAuth client is involved, ensure that consent and authorization are specific enough to the actual client and user; shared or static client arrangements can create confused-deputy risk.
Make sensitive actions explicit
Sending a message, changing a record, deleting data, or executing code can have consequences beyond returning information. Require an explicit, meaningful human confirmation for such actions and apply server-side policy checks that cannot be overridden by natural-language instructions. Validate the requested target and action before execution; record enough context to investigate the call without logging tokens or other secrets.
Does an MCP server need OAuth?
Not every deployment uses the same identity model. Whether OAuth is appropriate depends on how the server is exposed, which clients connect, and whether access must be tied to individual users. A local process and a remotely reachable HTTP service have different exposure and identity considerations. If remote authorization is used, configure the flow according to the actual MCP client, server, and authorization-server versions rather than assuming all implementations support the same discovery or registration behavior.
Token checks for remote authorization
The MCP Authorization Security Considerations documentation for version 2026-07-28 says a server should accept only access tokens issued for that server: validate token audience and do not return data to unauthorized callers. It also prohibits passing a client token through to an upstream API. The same version’s guidance covers secure token storage, HTTPS for authorization endpoints, PKCE for authorization-code protection, exact redirect-URI matching, and validating state where appropriate.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Microsoft’s Entra-specific implementation guidance recommends checking a token’s signature, issuer, tenant, audience, expiry, and whether its subject is authorized for the requested operation. That is a vendor-specific example, not a universal requirement to use Microsoft Entra ID or a single universal setup. Prefer established validation libraries or middleware over writing token validation yourself. Teams already using Microsoft identity infrastructure can consult Microsoft Entra ID for MCP authorization.
Check specification and client compatibility
The MCP project’s 2026-07-28 authorization announcement says Dynamic Client Registration is formally deprecated in favor of Client ID Metadata Documents, while remaining supported for backward compatibility in that version’s description. Before selecting or migrating an authorization flow, confirm what the deployed client, MCP server, and authorization server actually support. The announcement is version-specific; check the current specification and implementation documentation when deploying.
How should I secure a local MCP server?
A local server executes on a user’s machine and may be able to access local files, processes, or other system resources. The MCP project’s Security Best Practices also notes risks involving malicious startup configuration, compromised server payloads, and insecure local servers reachable through DNS rebinding. Treat the local installation as executable software, not as a harmless chat add-on.
- Review the server package’s origin, installation steps, startup command, and configuration before running it.
- Run it with the least host privilege needed; restrict filesystem paths and network access rather than giving blanket access.
- Use process isolation or sandboxing where available, and keep separate servers from being able to affect one another or the host unnecessarily.
- Protect credentials from broadly accessible files, process output, and logs. Rotate exposed credentials.
- Recheck package and configuration changes before updates, especially if the server gains new tools or access.
For remote HTTP servers, focus additionally on which networks and machines can reach the endpoint, transport security, caller identity, token audience validation, and authorization on each operation. Neither “local” nor “remote” is automatically safer: evaluate the actual host access, exposure, identity model, permissions, and isolation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose controls for the deployment, not a universal “safest” architecture
| Decision axis | Questions to answer |
|---|---|
| Exposure | Is this local stdio execution or a remote HTTP service? Which processes, machines, and networks can reach it? |
| Identity | Does it act as the individual user or a shared service identity? How are user-specific consent and permissions preserved? |
| Permission scope | Are tools read-only or write-capable? Are scopes and credentials narrow per operation, or broad and reusable? |
| Isolation | Are filesystem, process, network, and cross-server boundaries enforced? Can one server affect another or the host? |
| Integrity | Are source, versions, updates, startup configuration, and tool-metadata changes reviewed? |
| Execution safeguards | Are inputs and outputs validated? Do sensitive actions require approval? Are calls rate-limited and auditable? |
| Protocol compatibility | Which MCP version is supported? How do client and authorization server handle discovery, token audiences, and authorization changes? |
This comparison is more useful than choosing a deployment based on a blanket claim that one architecture or provider is safest. The controls should follow the access the server actually needs and the consequences of the operations it can perform.
Testing webpage capture in an MCP workflow
If an agent’s task includes capturing webpages, make the screenshot tool a narrowly scoped capability rather than giving an agent unrestricted browser or machine access. Treat page content and the resulting screenshot as untrusted input, and apply the same authorization and approval rules to any downstream action. ScreenshotNeo is a screenshot API and MCP server for developers; its presence in a workflow is not, by itself, a security control or a substitute for validating permissions.
Or skip the browser setup
For a direct screenshot request, one GET call can return an image or PDF. Store the API key as a secret rather than committing it to source control. See the ScreenshotNeo API documentation for request options and response handling.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpScreenshotNeo accepts cookie or consent banners as a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; those steps can be turned off. Bot checks and CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and responses report the page verdict and billing status in X-Page-Verdict and X-Billed. Its MCP server provides take_screenshot, get_page_info, and capture_pdf for Claude, Cursor, and other MCP clients. The Free plan includes 1,000 shots a month with no card; paid plans start at $5 for 3,000 shots. Every feature is available on every plan. These capabilities do not replace your own review of the MCP client’s access and behavior. Sign up for 1,000 free screenshots a month, with no card required.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Operational checks and common failure modes
Before enabling a server
- Confirm the package source, version, startup configuration, declared tools, and required permissions.
- Decide which users and operations are authorized, and test denied as well as allowed requests.
- For remote OAuth, verify issuer, audience, expiry, redirect URI, and client/server compatibility with the chosen flow.
- Check that secrets are stored and transmitted safely, and that logs do not expose them.
When something does not work
| Symptom | Likely cause | What to check |
|---|---|---|
| Valid-looking token is rejected | Wrong audience, issuer, tenant, expiry, or signature validation | Confirm the token was issued for this server and validate its claims with established middleware. |
| Upstream API call fails after enabling authorization | The server is forwarding the MCP client token or lacks a proper upstream credential | Use the correct upstream credential flow; do not pass the client token through. |
| User can see or change another user’s data | Shared identity, excessive scope, or missing per-operation authorization | Bind the operation to the verified principal and narrow scopes and credentials. |
| Tool behavior changes unexpectedly | Package, startup configuration, tool schema, or description changed | Compare the installed version and metadata with reviewed sources; disable until the change is understood. |
| Local server reaches files or services it should not | Excessive host permissions or insufficient process isolation | Restrict filesystem and network access, lower privileges, and sandbox the process. |
| Authorization setup cannot register a client | Client and authorization server may differ in support for registration or metadata discovery | Check compatibility with the MCP specification version in use and select a supported flow. |
Build security into ongoing operations
Security controls can drift when packages update, tool definitions change, permissions expand, or authorization systems migrate. Assign an owner to review those changes. Monitor which principal invoked which tool, the operation requested, the authorization decision, and the outcome. Rate limits and alerts can help surface abnormal use, but do not replace permission checks. Keep logs useful for investigation and free of access tokens, passwords, and unnecessary sensitive content.
Best Value
OWASP’s MCP Security Cheat Sheet includes supply-chain security, installation consent, multi-server isolation, transport security, validation, human approval, monitoring, and auditing among its control areas. Treat this as a layered program: identity enforcement, least privilege, isolation, integrity review, safe handling of untrusted content, action safeguards, and monitoring reinforce one another. No single prompt instruction or security product can stand in for those controls.
Frequently Asked Questions
Is an MCP gateway enough to secure my server?
No single gateway or identity product replaces server-side authorization, least privilege, isolation, tool and package review, validation, and operational monitoring.
Should I use a prompt filter to stop tool poisoning?
A filter may be one layer, but model instructions or filtering alone do not prevent unauthorized tool calls. Enforce permissions and policy outside the model.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
