MCP security: the main risks and what the MCP project advises

MCP security is the set of controls around the Model Context Protocol, an open-source standard for connecting AI applications to external systems (MCP project, What is the Model Context Protocol, read 10 November 2026). Because an MCP connection lets an AI application reach real systems, its security comes down to who can connect, with what credentials, and what the connection is allowed to do.

The MCP project's security best practices page says it identifies security risks, attack vectors and best practices specific to MCP implementations. Its stated audience is developers implementing MCP authorization flows, MCP server operators, and security professionals evaluating MCP-based systems (read 10 November 2026).

The page calls token passthrough an anti-pattern and says it is explicitly forbidden in the MCP authorization specification. Its stated mitigation is direct: MCP servers must not accept any tokens that were not explicitly issued for the MCP server.

It gives reasons. Passing tokens through can let a client bypass controls such as rate limiting and request checks that depend on who a token was issued to. It can also hide who really made a request, because the downstream service's logs show a different identity from the server that forwarded the call. The page says both make incident investigation, controls and auditing more difficult.

As little as the first task needs. The page warns that a token carrying broad scopes, such as full file or database access granted up front, means a stolen token enables lateral data access and is hard to revoke without asking the user to consent again.

Its mitigation is a progressive, least-privilege model: begin with a minimal set of low-risk discovery and read operations, ask for more only when a privileged action is first attempted, and log those elevation events. For one named client, Anthropic's Claude Code documentation tells users to verify they trust each MCP server before connecting it, and says servers that fetch external content can expose them to prompt injection risk (Anthropic, read 10 November 2026).

Kriv AI designs and builds governed AI agents connected to a client's own systems, and trains the people who work alongside them. For MCP, our work is informed by the MCP project's security guidance and Anthropic's documentation: listing which servers an agent may use, keeping approvals with named people, and logging what each connection does. This page is general information, not a security assessment, and it does not promise that any setup is protected from attack.