Hardening MCP Servers

AI is moving into a new phase, with the Model Context Protocol turning isolated AI models into agents that can read files, call APIs and act across your systems. On top of that, it gave attackers a brand-new, wide-open surface. In less than two years, MCP went from being a good idea to being a critical infrastructure, and its security never kept pace. This practical, solution-focused field book is the first thing you need to get the job done.
This cookbook is built around a single server and you can use it to harden things recipe by recipe. It works through more than fifty real vulnerabilities drawn from a scan of over eleven thousand production servers. You'll be closing code-execution sinks, pinning a runaway dependency supply chain, catching tools that mutate after approval, and enforcing authentication that servers only pretend to require.
It'll be your job to defend the agent's own context against prompt injection and tool poisoning, lock down OAuth flows, protect consent screens, isolate untrusting servers on a shared host, and set the operational defaults that decide how far any single flaw can travel. Every recipe describes the problem, shows the working code to solve it, and proves that the solution works. If you build, run, or secure MCP servers on Linux, this book will help you turn your experience into everyday, repeatable practice. Key LearningsTreat every tool argument as attacker-controlled, and replace risky primitives with narrow, safe alternatives.
Pin, hash, and audit the entire dependency tree so nothing changes without review. Catch rug pulls by hashing approved tool definitions and re-verifying them every session. Enforce authentication and per-tool authorization in code, never merely declare it in a manifest. Defend the agent context by stopping tool content from ever triggering actions. Validate token audience and issuer so a credential works only where intended.
Secure OAuth flows with PKCE, bound state parameters, and per-client consent. Protect human consent against clickjacking and fatigue with framing rules and rare prompts. Isolate untrusting servers on a shared host by namespacing tools and scoping context. Contain blast radius through sandboxing, least privilege, audit logging, and rate limiting. Table of ContentExposure to Opportunity of MCPCode-Execution SinksSupply ChainRug Pulls and Tool-Definition IntegrityAuthentication and Access ControlMCP-Native and Prompt-Layer AttacksOAuth Flow and Token IntegrityConsent, Discovery, and Credential Blast RadiusAgent-Layer and Trust-Boundary AttacksOperational Hygiene and Insecure Defaults