MCP Security Best Practices

An MCP server is a program that runs on your machine, as you, with whatever credentials you give it. That's powerful — and dangerous if you're careless.

The threat model

• A server can read your files, hit your APIs, and run code.
• A malicious (or buggy) server can exfiltrate data or make destructive calls.
• Prompt injection: a website or document you ask the agent to read can contain instructions that hijack it into calling tools unexpectedly.

Hard rules

1. Never add an MCP server you don't trust — it's like installing a dependency with your SSH keys.
2. Least privilege — give a server only the token scopes it needs (read-only where possible).
3. Keep secrets in env, never in args (args show up in process lists).
4. Prefer local servers over remote ones for anything touching private data.
5. Pin versions — npx -y package@1.2.3, not a floating latest.

Sandbox the risky stuff

For servers that run arbitrary code (browsers, shells), isolate them:

# Docker-based MCP servers keep the blast radius small
docker run -i --rm ghcr.io/.../playwright-mcp

Prompt-injection hygiene

• Review tool calls an agent makes before approving them.
• Don't auto-approve tools that write, send, or delete.
• Treat any fetched web content as untrusted.

A sane default

Start in "ask before every tool call" mode. Approve quickly for a trusted server, and only then whitelist it. Trust is earned per server, not globally.

MCP is safe when you treat servers like privileged code, not like plugins. They're the most consequential thing you'll install for your AI stack.