What is MCP security?

Per-call authorization is most useful as plain, versionable text. A workable minimum for the MCP layer: nothing is permitted until granted, grants name the agent and the tools, and destructive tools pause for a human. In YAML:

# Default posture: a connected client can do nothing.
- agent: "*"
  server: "*"
  tool: "*"
  action: block

# The triage bot may read issues and comment — nothing else.
- agent: triage-bot
  server: github
  tool: [get_issue, list_issues, create_comment]
  action: permit

# Repo-destructive tools pause for a human, every time.
- agent: "*"
  server: github
  tool: [delete_repository, force_push]
  action: require_approval

# The reporting agent may query — but never write.
- agent: report-bot
  server: postgres
  tool: query
  when: { read_only: true }
  action: permit

Where this policy runs matters as much as what it says. Enforce it in a proxy placed in front of the MCP servers — outside the agent process — and it cannot be steered from inside that process. A poisoned tool description or an injected result can fool the model, but the fooled model's calls still arrive at the proxy, still get evaluated, and the blocked ones never reach the server. Enforcement that lives inside the agent shares the agent's fate; enforcement in the request path does not.

• ◈Treat MCP servers as third-party code. Read the source and the tool descriptions before connecting one, exactly as you would review a dependency before adding it to production.
• ◈Scope the credentials each server holds. The server's token is the ceiling on what any agent can do through it — a read-only token makes an entire attack class moot.
• ◈Enforce default-deny per-call policy. A connected client should be able to do nothing until a rule explicitly permits the agent, the tool, and the conditions.
• ◈Give every agent its own identity. Shared credentials across agents make per-call authorization impossible to reason about and attribution impossible to recover.
• ◈Log everything, including blocks. A denied call is often the earliest signal of a poisoned tool description or an injected agent — the blocks are the interesting lines.
• ◈Alert on anomalous call patterns. A changelog bot that suddenly enumerates repositories, or any agent making calls at machine-speed bursts, warrants a page, not a dashboard entry.