Secure MCP Servers and Agent Tools
Treat model-generated tool calls as untrusted requests that still need normal application security.
Stop cross-tenant data leaks
A SaaS MCP server exposes get_invoice(invoice_id). The dangerous implementation fetches by invoice ID only. The safe implementation scopes every lookup to the authenticated tenant.
# unsafe
invoice = db.invoice.get(invoice_id)
# safer
invoice = db.invoice.find_one(
id=invoice_id,
tenant_id=context.tenant_id
)
if not invoice:
raise NotFound()Model prompt
Useful for explaining intent, never for enforcing identity or permissions.
Server policy
The only place that can reliably enforce tenant boundaries, scopes and destructive-action rules.
Security rule: if the same API call would be unsafe from a malicious mobile client, it is also unsafe from an AI agent.