MCP Security Best Practices
Architecture and configuration patterns for safer Model Context Protocol deployments.
These practices are distilled from OWASP guidance, NSA recommendations, and real-world incident patterns observed in agentic systems. They apply whether you are running one MCP server or dozens across multiple clients.
1. Treat every MCP server as untrusted by default
MCP servers execute code and return data to your LLM. Assume any server could be compromised, abandoned, or intentionally malicious. Apply the same supply-chain scrutiny you use for npm packages or Docker images.
2. Keep secrets out of config files
Storing API keys, tokens, or credentials in `claude_desktop_config.json`, `.cursor/mcp.json`, or any plaintext file is a common source of leakage. Use a secrets manager, OS keychain, or environment-specific secret injection.
3. Scope permissions to the tool level
Do not grant a server blanket access to your environment. Define which tools it can call, which arguments are allowed, and what data it can read or write. Use a gateway or policy layer to enforce this.
4. Validate and sanitize tool arguments
Treat arguments coming from the LLM as untrusted input. Validate types, ranges, and allowed values before executing any tool. Reject or escape arguments that could be used for command injection or path traversal.
5. Inspect tool responses before showing them to the LLM
Tool responses can contain instructions, advertisements, or prompt-injection payloads. Pass responses through a sanitization or filtering layer before they reach the LLM context window.
6. Log and monitor every tool call
Record who called the tool, which server was used, the arguments, the response summary, and the outcome. Ship these logs to a SIEM and alert on anomalies like new servers, unusual arguments, or high failure rates.
7. Isolate MCP servers in restricted runtimes
Run MCP servers in containers, sandboxes, or least-privilege processes with limited network and filesystem access. Deny egress by default and only allow connections to explicitly approved endpoints.
8. Require explicit user consent for high-risk actions
Any tool that writes data, sends messages, makes purchases, or accesses sensitive systems should require explicit human approval. Do not rely on the LLM to decide whether an action is safe.
9. Have a revocation and rotation plan
Know how to remove an MCP server, rotate its credentials, and audit its historical access in under 15 minutes. Document the runbook before you need it.
Get the printable checklist
Turn these practices into a one-page review template for your team.
Read the checklist