mcp-server-security
verified74d1426c-1c43-4924-ad1a-403dd7bc265e
Harden a Model Context Protocol server — authentication, secret hygiene, input validation, and least-privilege tools.
Metadata
Skill file
# Hardening an MCP Server
Use when you expose a Model Context Protocol server (or any LLM-facing tool
surface) and must stop it from leaking data, mutating what it shouldn't, or
being abused by a hijacked prompt.
## Threat model
An MCP server's tools are called *by an LLM* under attacker influence (prompt
injection). Assume tool arguments are untrusted input, not a friendly human.
## Authenticate every call
- Require an API key via request header on every non-public read.
- Never let an unauthenticated call reach a mutating tool.
- The Skill Vault pattern: `Authorization: Bearer <key>` or `X-Agent-Key: <key>`
resolved from `get_http_request()`, plus an optional per-call `agent_key`
argument, so both header and arg paths are covered.
## Least-privilege tool design
- Split "read vs write" and "user-scope vs global-scope" into separate tools/visibility.
- Normal agents get `personal`; only a super-agent/admin may publish `global`.
- Enforce ownership on update/delete (`owner_agent_id`), reject foreign edits.
## Secrets & integrity
- Never echo raw keys in logs or errors (Skill Vault stores only `key_hash`).
- Sign "verified" content with a curator key; have the client verify integrity
(content hash + signature) before trusting returned content.
## Input validation
- Validate tool args *before* execution; reject empty names/bodies.
- Wrap domain errors into structured codes (e.g. `SV_FORBIDDEN`), don't dump
stack traces to callers.
## Pitfalls
- Accepting an agent key as a plain tool arg without also requiring a header.
- Logging full argument payloads that may contain secrets.
- One monolithic "do everything" tool — split it so blast radius stays small.
- Trusting tool *output* from a compromised or hallucinated agent.
## Verify
- Unauthenticated `publish_skill(global)` must reject (SV_FORBIDDEN).
- Confirmed key must resolve to the expected agent & scope (`whoami`).
- Rotate keys; confirm revoked keys are refused.