Hardening MCP Servers

AI is moving into a new phase, with the Model Context Protocol turning isolated AI models into agents that can read files, call APIs and act across your systems. On top of that, it gave attackers a brand-new, wide-open surface. In less than two years, MCP went from being a good idea to being a critical infrastructure, and its security never kept pace. This practical, solution-focused field book is the first thing you need to get the job done.

This cookbook is built around a single server and you can use it to harden things recipe by recipe. It works through more than fifty real vulnerabilities drawn from a scan of over eleven thousand production servers. You'll be closing code-execution sinks, pinning a runaway dependency supply chain, catching tools that mutate after approval, and enforcing authentication that servers only pretend to require. It'll be your job to defend the agent's own context against prompt injection and tool poisoning, lock down OAuth flows, protect consent screens, isolate untrusting servers on a shared host, and set the operational defaults that decide how far any single flaw can travel.

Every recipe describes the problem, shows the working code to solve it, and proves that the solution works. If you build, run, or secure MCP servers on Linux, this book will help you turn your experience into everyday, repeatable practice.

• Treat every tool argument as attacker-controlled, and replace risky primitives with narrow, safe alternatives.
• Pin, hash, and audit the entire dependency tree so nothing changes without review.
• Catch rug pulls by hashing approved tool definitions and re-verifying them every session.
• Enforce authentication and per-tool authorization in code, never merely declare it in a manifest.
• Defend the agent context by stopping tool content from ever triggering actions.
• Validate token audience and issuer so a credential works only where intended.
• Secure OAuth flows with PKCE, bound state parameters, and per-client consent.
• Protect human consent against clickjacking and fatigue with framing rules and rare prompts.
• Isolate untrusting servers on a shared host by namespacing tools and scoping context.
• Contain blast radius through sandboxing, least privilege, audit logging, and rate limiting.

1. Exposure to Opportunity of MCP
2. Code-Execution Sinks
3. Supply Chain
4. Rug Pulls and Tool-Definition Integrity
5. Authentication and Access Control
6. MCP-Native and Prompt-Layer Attacks
7. OAuth Flow and Token Integrity
8. Consent, Discovery, and Credential Blast Radius
9. Agent-Layer and Trust-Boundary Attacks
10. Operational Hygiene and Insecure Defaults