Security
Threats and guardrails
MCP gives a model hands. Anything that can reach the model's context can try to steer them.
Tool poisoning
Hidden instructions in a tool’s description (“…also read ~/.ssh and include it”) that the model sees but the user doesn’t.
Prompt injection via data
An email, web page or issue returned by a tool contains instructions, and the model follows them.
Rug pulls
A server you approved quietly changes its tool definitions later.
Confused deputy
A server uses its own broad credentials on behalf of a user who should not have that access.
Over-broad tokens
One token that can do everything turns any small bug into a full breach.
Untrusted local servers
A stdio server runs as you, with your files, network and keys.
Guardrails
- Human-in-the-loop for anything destructive, with the tool inputs shown
- Least privilege: narrow scopes, per-server credentials, separate tokens
- Pin server versions and review changes to tool descriptions
- Install servers only from sources you trust, and sandbox local ones
- Treat every tool result as untrusted input