A dense, scannable reference for Model Context Protocol security: threats at a glance, pre-connection checklist, config hardening, detection tools, and a mini IR runbook.
A dense, scannable reference for securing Model Context Protocol (MCP) servers and clients. Use it as a pre-connection checklist and a hardening reference. For the full explanation behind every row, see The MCP Security Complete Guide.
MCP roles and transports (quick reference)
Term
What it is
Host
The AI app the user runs (Claude, Cursor, VS Code) that embeds one or more clients
Client
The connector inside the host that speaks MCP to a single server
Server
The process exposing tools, resources, and prompts to the agent
Tool
A callable function the model can invoke (the main attack surface)
Resource
Read-only data the server can supply as context
Prompt
A reusable prompt template the server offers
stdio
Local transport; server runs as a child process with your privileges
Streamable HTTP
Current remote transport; data leaves the machine, needs auth + TLS
SSE (legacy)
Older HTTP transport; prefer Streamable HTTP for new setups
Threats at a glance
Threat
What it is
How to detect
Tool poisoning
Hidden instructions embedded in a tool description that the model reads and obeys
Inspect raw tool descriptions; look for model-directed text ("always", "ignore previous", references to files/other tools)
Prompt injection
Untrusted content (web page, file, message) carries instructions that hijack the agent
Track which tools return external content; treat all fetched/read data as untrusted
Rug pull
An approved server is silently changed after review, so later code differs from what you vetted
Compare pinned version/hash against what runs; watch for unpinned auto-installs
Tool shadowing
A malicious server redefines or overrides another server's tool to intercept calls
Watch for duplicate/near-duplicate tool names across servers; inspect definitions
Excessive permissions
A server requests broader scope than its job needs (write, network, wide paths)
Enumerate tools and scopes; compare to the minimum the task requires
Secret exposure
Tokens, keys, or passwords stored in plaintext config or leaked to the model
Grep config for secrets; audit what data reaches the model and logs
Lethal trifecta
One agent has private-data access + untrusted-content exposure + external communication at once
Map each connected tool to these three capabilities; flag any agent holding all three
Pre-connection checklist
Identify the real repository and maintainer; reject lookalike package names and unofficial forks.
Read the raw tool descriptions the server sends to the model, not just the README.
Authorization and ethics: only inspect, scan, and connect MCP servers you own or are authorized to assess, and hold to the read-only limits set out in the scanning policy. Vetting protects your systems; it is not a license to probe someone else's. When you are ready, take the whole checklist live at the MCP security hub.
