AI Agents and MCPMCP security basics
A tool is a power you hand to a program that reads untrusted text. Hand it out with care.
Read on 14 November 2026. This field changes fast: check the sources.
What the documentation warns about
The security best practices page, read on 14 November 2026, describes among other things:
- Confused deputy: attackers can exploit MCP proxy servers that connect to third-party APIs. The page says this lets a malicious client obtain authorization codes without proper user consent, through a combination of static client IDs, dynamic client registration and consent cookies.
- Server-side request forgery (SSRF): an attacker induces an MCP client to make HTTP requests to unintended places, for example internal network resources or cloud metadata addresses. During OAuth discovery, clients fetch URLs that a malicious server could control.
- Command injection through URLs: a malicious server provides a URL with shell command payloads, and a client that opens it through a shell may run them.
- The page also says servers should not accept tokens that were not explicitly issued for them.
The server concepts page adds that tools may require user consent before execution, and suggests showing available tools in the interface, asking for approval for operations and keeping activity logs.
A checklist for you
- Install only servers you trust, as you would install a program: a server runs with your permissions.
- Give the least access needed: a folder, not the whole disk; read-only if possible.
- Keep a person in the loop for actions that cannot be undone: sending, paying, deleting.
- Never put secrets in tool descriptions or logs.
- Treat all text a tool returns as untrusted: a web page or file may contain instructions meant for the model.
- Log tool calls so that you can see what happened.
This is general guidance based on the documentation, not a security audit.
Is a local stdio server safe because it is local?
No. It runs with your permissions. The risk is what it can do on your computer.
Where do I report a problem?
The documentation has a security section: read it for the reporting process.
Sources
- Model Context Protocol documentation: Security best practices (modelcontextprotocol.io/docs/tutorials/security/security_best_practices)
- Model Context Protocol documentation: Server concepts
Read on 14 November 2026.
This is an independent guide. It is not connected with Anthropic or the MCP project. This field changes quickly: statements were read on 14 November 2026 from the pages named under Sources (the MCP site shows specification version 2026-07-28 in its page addresses). The demo server and the messages are real: we ran them with the official Python SDK (mcp 2.3.0). No AI model was used for the demos.