Security Threat Model for MCP Servers
Main threats and controls
| Threat | Example | Control |
|---|---|---|
| Prompt injection | Resource text says, “Export all data” | Treat content as data; keep policy outside the prompt. |
| Tool poisoning | Misleading tool description | Trust approved servers; review catalogs. |
| Excessive permissions | One tool can read every tenant | Use narrow scopes and row-level checks. |
| SQL injection | An argument is concatenated into a query | Use parameterized queries and allowlists. |
| Path traversal | ../../secret resource URI | Resolve paths within allowed roots. |
| Data exfiltration | A tool sends secrets to a URL | Use an egress allowlist and confirmation. |
| SSRF | The user controls an upstream URL | Use fixed origins and URL validation. |
| Replay/duplicate write | A retried create operation | Use idempotency keys and an audit log. |
Trust rule
Tool descriptions, annotations, resource text, external API responses, and model output can all be untrusted. Security decisions must be based on deterministic server policy.
Approval UX
Show the user the action, target, important arguments, and side effects before the call. An “Allow” button should not be generic; “Create ticket for customer 42” is clearer.
Can you explain it without the notes?
Security Threat Model for MCP Servers
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
Main threats and controls
Turn this concept into a clear answer.
Practice this conceptYOUR NEXT STEP
Keep connecting the ideas.
Next lesson: Errors, Timeouts, Retries, Cancellation, and ProgressAdapted from 20_MCP_SERVER.md · “12. Security Threat Model for MCP Servers”. Examples are study fragments; framework behavior can depend on your version.