智能体 / NAVIN RESEARCH
Secure an MCP Server Before Connecting AI Agents
A deployment checklist for authentication, authorization, consent, validation, and least-privilege Model Context Protocol tools.
A deployment checklist for authentication, authorization, consent, validation, and least-privilege Model Context Protocol tools.
简要回答: Treat an MCP server as a security boundary. Authenticate clients, authorize every operation, validate all arguments, minimize tool scope, protect tokens, and require user confirmation for consequential actions. A trusted model does not make an untrusted tool safe.
实施步骤
- Threat-model the server, upstream APIs, client, and transport separately.
- Issue short-lived credentials with the narrowest scopes and bind them to the intended audience.
- Validate redirect URIs and prevent token passthrough to downstream systems.
- Log security events without storing prompts, secrets, or sensitive tool results unnecessarily.
验证清单
- Attempt cross-tenant access and confused-deputy flows.
- Test prompt-injected arguments against server-side authorization.
- Confirm revoked credentials fail immediately or within the documented window.
常见错误
- Using one administrator token for all users.
- Relying on natural-language instructions as access control.
- Automatically approving writes because they originated from an agent.
实际决策
先交付能够通过上述检查的最小设计。记录测试中使用的模型、提示词、工具、数据集与运行时版本，让后续变化可以被比较而不是被猜测。依赖供应商的限制、模型名称、价格或预览功能之前，请重新检查链接文档；这些细节变化往往快于本文的工程原则。
