Protect a Remote MCP Server

Treat a remote MCP server like a privileged API, not a demo endpoint.

Production checklist

• HTTPS only.
• Strong token validation and audience checks.
• Least-privilege scopes.
• Rate and concurrency limits.
• Request body and tool result size limits.
• Network egress restrictions where practical.
• Audit logs for sensitive actions.
• Timeouts and circuit breakers for downstream systems.

Use gateways carefully

The 2026 Streamable HTTP headers make routing and policy enforcement easier at gateways, but the server must still validate authorization itself.