MCP Security: What Developers Need to Know
MCP connects models to capabilities that may read private data or perform real actions. Security therefore has to exist at every layer: server trust, identity, authorization, tool design, user approval, network boundaries, and downstream services.
Threat model first
Document what the server can access, whose credentials it uses, which tools mutate state, what data can reach the model, and which callers can connect.
Five core controls
- Connect only to trusted servers.
- Use least-privilege credentials.
- Enforce authorization server-side.
- Require approval for high-impact actions.
- Trace and audit tool use without logging secrets.
Model instructions are not an access-control mechanism. Security decisions must be enforced in code and infrastructure.