MCP security: injection, permissions and blast radius
The MCP threat model is not the protocol — it is the tools you hand the model and the credentials behind them. A server that can run arbitrary SQL in your name is a risk whether or not it speaks MCP.
Prompt injection is the sharpest edge: tool output is untrusted input. A GitHub issue, a scraped page, or a support ticket can carry instructions, and an agent that treats tool results as commands will follow them. The defence is scoping and confirmation, not cleverer prompts.
These pieces cover the failure modes we see repeatedly, and the specific mitigations — read-only defaults, narrow scopes, separate integration accounts, human confirmation on writes.
Assume every tool result is attacker-controlled text. Design the permission scope so that being wrong about that is survivable.
2 articles
MCP OAuth: how remote-server auth works
Local servers skip auth entirely. The moment you go remote, OAuth 2.1 shows up — here's exactly what it's doing and why the flow looks the way it does.
What I learned reading the security notes of 300 MCP servers
I went through the security profile of every server we track. The real risks are boring, concrete, and mostly about what you hand the model — not the protocol.
FAQ
What is MCP prompt injection?
It is when text returned by a tool is treated by the agent as instructions. A GitHub issue, a scraped page or a support ticket can carry a line like 'ignore previous instructions and…', and an agent that trusts tool output will act on it. Tool results are untrusted input, always.
Is MCP safe to use with production data?
It can be, with scoping. The risk is not the protocol — it is handing a model credentials that can do damage. Use a dedicated integration account, read-only by default, with write access granted per tool and confirmed by a human.
How do I limit what an MCP server can do?
Three layers, in order of effectiveness: credential scope (the server literally cannot exceed its token's permissions), server configuration (read-only flags, allowed paths, query guards), and client-side confirmation for destructive calls. Prompt instructions are the weakest layer — never the only one.
Other topics
Looking for a server rather than an article? Best MCP servers by task