Security Threat Model for MCP Servers
Practice this questionWANT TO UNDERSTAND THE CONCEPT FIRST?Learn Security Threat Model for MCP Servers
Main threats and controls
| Threat | Example | Control |
|---|---|---|
| Prompt injection | Resource text says, “Export all data” | Treat content as data; keep policy outside the prompt. |
| Tool poisoning | Misleading tool description | Trust approved servers; review catalogs. |
| Excessive permissions | One tool can read every tenant | Use narrow scopes and row-level checks. |
| SQL injection | An argument is concatenated into a query | Use parameterized queries and allowlists. |
| Path traversal | ../../secret resource URI | Resolve paths within allowed roots. |
| Data exfiltration | A tool sends secrets to a URL | Use an egress allowlist and confirmation. |
| SSRF | The user controls an upstream URL | Use fixed origins and URL validation. |
| Replay/duplicate write | A retried create operation | Use idempotency keys and an audit log. |
Trust rule
Tool descriptions, annotations, resource text, external API responses, and model output can all be untrusted. Security decisions must be based on deterministic server policy.
Approval UX
Show the user the action, target, important arguments, and side effects before the call. An “Allow” button should not be generic; “Create ticket for customer 42” is clearer.
Adapted from 20_MCP_SERVER.md · “12. Security Threat Model for MCP Servers”. Code examples are study fragments. Difficulty and core labels are editorial estimates; version-specific behavior should be checked against your project.