MCP Security for AI Agents
The Model Context Protocol (MCP) standardizes how AI applications connect to tools, resources, and prompts. It also standardizes the attack surface: every MCP server you connect is code your model can invoke, with your credentials and your data. MCP security is the set of mechanisms that keep that attack surface under control — authentication, input validation, tool-call authorization, and monitoring.
RESK maintains resk-mcp, an open-source security layer over the official MCP Python SDK, and this guide explains the security model behind it. For a threat-oriented walkthrough, read MCP Security: Protecting AI Agents from Model Context Protocol Threats.
What Is MCP Security?
An MCP deployment has three trust boundaries: the client (your agent), the server (the tool provider), and the transport between them. MCP security means enforcing policy at each boundary: the client must authenticate servers and validate their outputs, the server must authenticate clients and validate every request, and neither side should trust model-generated tool arguments as if they were human input.
The MCP Attack Surface
- Tool poisoning — a server advertises a benign tool whose description or output carries hidden instructions (in-context injection aimed at the model).
- Over-privileged tools — a tool that can read files, query databases, or call external APIs with more permissions than the task requires.
- Context poisoning — malicious content injected into shared context through tool results or resources.
- Confused deputy — the model is tricked into combining two legitimate tools in an illegitimate way (e.g., read a secret, then send it out).
- Session and transport attacks — unauthenticated transports, session hijacking, replay of tool calls.
MCP Security Mechanisms
Four mechanisms address this surface. They map directly to what resk-mcp implements:
🔐 Authentication and identity
- JWT-based client authentication with rotation and expiry
- API-key validation for machine-to-machine clients
- Per-user identity carried through every tool call — no shared service accounts
🛡️ Input validation and sanitization
- Schema validation of every request (method and parameter shape)
- Prompt-injection detection on tool arguments and tool outputs before they reach the model context
- Method allowlisting — only
tool/,resource/,prompt/namespaces pass
🔑 Tool-call authorization
- Per-user capability bitmasks decide which tools a caller may invoke
- Deny-by-default: a tool not granted to the caller's role returns an authorization error
- Least privilege per integration, not per deployment — the same principle as our RBAC bitmask model for LLMs
📊 Monitoring and audit logs
- Every tool call logged with caller identity, arguments, and result status
- Rate limiting per user and per method to contain runaway agents
- Interaction counters and anomaly signals exportable to your observability stack (Datadog, Prometheus, OTel via ReskPoints)
MCP Security Layers
Layered defense for MCP mirrors any zero-trust design. Transport layer: encrypt, authenticate endpoints, rate-limit. Protocol layer: validate messages against the MCP schema, authenticate sessions. Policy layer: decide who may call which tool with which arguments — this is where authorization bitmasks and deny-by-default rules live. Audit layer: record everything and alert on anomalies. A deployment missing any layer trusts the layers below it to do a job they were not designed for.
MCP Security Considerations Before You Ship
- Inventory every MCP server you connect and the permissions its tools actually need — retire the rest.
- Treat tool descriptions and outputs as untrusted input; scan them like user prompts.
- Authorize tool calls per user and per role, not per client application.
- Log tool calls with identity and arguments — without an audit trail, incident response is guesswork.
- Test with hostile servers: our AI pentesting practice includes MCP-specific attack scenarios.
MCP Security Implementation in Python
resk-mcp (published as mcp-resk on PyPI) wraps the official MCP Python SDK with the mechanisms above:
pip install mcp-resk — then subclass SecureMCPServer to get JWT authentication, request validation, rate limiting, per-user tool authorization, and audit logging on top of the standard FastMCP interface. Configuration is YAML-driven (see the GitHub repository for the full setup).
Go Deeper
- MCP Security Integration: Hardening MCP Servers Step by Step — the hands-on guide
- MCP Security: Protecting AI Agents from MCP Threats — attack walkthroughs
- AI Agent Security — tool permissions and observability beyond MCP
- LLM Security — the full input/context/output/action model
- Tool Permissions for AI Agents: Least Privilege in Practice
Connecting agents to MCP servers? Put authentication, authorization, and audit in front of every tool call.
Explore resk-mcp View on GitHub Get Enterprise Support