Model Context Protocol · hub
MCP Security: Tools, Labs and Checklist
An MCP server gives an AI agent tools, so a bad one can steer the agent, overreach or leak data. Check each server before you connect it, and again when its tools change.
What MCP server security covers
Tool poisoning
Instructions hidden in a tool’s name, description or results that the model reads and obeys. The tools spec says clients MUST treat tool annotations as untrusted unless they come from trusted servers, SHOULD validate tool results before passing them to the model, and that a human SHOULD always be able to deny a tool call.
Over-broad tool scopes
A server that asks for every permission up front turns one stolen token into access to everything. The spec’s security best practices call for a minimal initial scope set and step-up requests only when a privileged operation is first attempted.
Rug pulls
A server you approved changes what its tools do or say later. The spec lets a server announce that its tool list has changed, so treat any change to tools or descriptions as a new review, and pin the version you approved.
Secrets and tokens
API keys pasted into config files leak with the file. On the server side, the spec says MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server, and token passthrough is forbidden.
Transport and auth
A local server runs with your privileges, so clients MUST show the exact command and get consent before a one-click install, and SHOULD sandbox it. Remote servers that implement authorization MUST verify all inbound requests, and clients SHOULD require HTTPS for OAuth URLs.
MUST and SHOULD are quoted from the MCP security best practices and tools specification.
Tools and labs
Start with the checklist, lint the config, then scan the server. Pro tools: a free account includes 3 Pro tool runs.
MCP Server Security Checklist(Pro)
Pick the server type and transport, answer the checks, and get a score, a safe-to-use verdict and a fix list.
MCP Server Security Linter(Pro)
Paste a server config or tool manifest to flag hard-coded secrets, dangerous tool capabilities, unconstrained parameters, missing auth and plaintext transport. Runs in your browser.
MCP Guard(Pro)
Static audit of an MCP client config (claude_desktop_config.json or mcp.json) for plaintext secrets, unpinned remote installs, shell pipes and over-broad filesystem roots.
Malicious MCP Server Scanner(Pro)
Screen a server’s tools for tool poisoning, data exfiltration, secret access, arbitrary execution, over-broad scope and rug-pull risk before you connect an agent.
MCP Scan(Pro)
A public explorer of hygiene scores for registry-listed MCP servers, from 27 checks over one standard MCP handshake. Scanning your own server is part of Pro.
MCP Server Governance & Risk Check(Pro)
Answer the OWASP MCP governance gates and risk factors to get an approve, conditional or block verdict and the controls to add.
MCP Rug-Pull Lab(Pro)
Safe simulation: review a queue of MCP servers, name the attack (tool poisoning, rug pull, shadowing, over-broad scope, missing auth, exfiltration) and the control that catches it.
Reading
MCP Server Vulnerabilities and How to Secure Them
The main attack classes and the controls that close them.
MCP Tool Poisoning: How Hidden Instructions Hijack Your AI Agents
How poisoned tool descriptions work and how to spot them.
MCP Server Best Practices: A Security Checklist for CISOs
The checklist view for leaders approving MCP use.
MCP Server Registry: How to Vet Servers Safely
What a registry listing does and does not tell you.
MCP Server Governance: The Controls That Keep AI Tool Access Safe
Ownership, logging, scope and review for MCP in the enterprise.
OWASP MCP Governance & Risk: Should You Allow That Server?
The OWASP framework behind the governance check.
LiteLLM CVE-2026-59822 on CISA KEV: Forged MCP Sessions
A real MCP session flaw on the KEV list, and what to do.
How to scan an MCP server for risks
Step-by-step guide to checking a server before you connect it.
Questions
What is MCP server security?
MCP server security is making sure a Model Context Protocol server cannot be used to steer, overreach or leak through the AI agent that connects to it. The main risks are tool poisoning (hidden instructions in tool descriptions or results), over-broad tool scopes, rug pulls (a server changing its tools after you approved it), secrets in config files or tokens accepted for the wrong service, and weak transport or authentication. Review a server before you connect it and again whenever its tools change.
What does MCP security cover?
It covers both sides of the connection. On the server: validate tool inputs, enforce access controls, rate limit and sanitize outputs, accept only tokens issued for that server, and ask for the smallest scopes that work. On the client: treat tool descriptions and annotations from untrusted servers as untrusted, show the user what a tool will be sent, ask for confirmation on sensitive operations, get consent before running a local server command, and log tool use.
Is MCP secure?
The protocol includes security requirements, such as an authorization specification, a ban on token passthrough and a list of security best practices, but it does not make every server safe. Any MCP server can be badly written or malicious, and a local server runs with the same privileges as the client that launched it. MCP is as secure as the servers you allow and the controls your client enforces, so vet each server, pin its version, limit its scopes and keep a human able to deny tool calls.
What is MCP tool poisoning?
Tool poisoning is when a server puts instructions in a tool name, description or result that the model treats as something to do, for example to read a file or send data somewhere. The user often never sees the text. The MCP tools specification says clients must treat tool annotations as untrusted unless they come from trusted servers and should validate tool results before passing them to the model.
What is an MCP rug pull?
A rug pull is when an MCP server that looked safe when you approved it later changes the behaviour or description of its tools, for example after an update. Pin the version you reviewed, watch for tool-list changes, and treat any change as a new approval.