mcp-server-securitylisted

# MCP Server Security ## Purpose An MCP server is an **attack surface an AI agent invokes on the user's behalf**, which combines two threat models: ordinary service security (injection, SSRF, secrets, DoS) and LLM-specific risks (prompt/tool-poisoning injection, confused deputy). Because the model will call tools with attacker-influenced arguments and read back tool/resource content into its context, a small server flaw becomes an agent-level compromise. This skill is the threat model and the mitigations to apply and to audit for. It complements `mcp-authorization` (identity/access) with the rest of the surface. ## The threat model, by trust boundary | Boundary | Risk | Mitigation | |---|---|---| | Client → server identity | confused deputy, token passthrough | validate `aud`; never forward the incoming token (see `mcp-authorization`) | | Tool arguments → system calls | command / SQL / path injection, SSRF | validate + parameterize; allowlist; never build shells/URLs from raw args | | Server → model (tool/resource output) | prompt injection, tool poisoning | treat all returned content as untrusted; do not let it carry instructions | | Anyone → server | DoS, resource exhaustion | size caps, timeouts, rate limits, pagination | | Server config → logs/errors | secret leakage | secrets from env/store; never log tokens or put internals in results | ## Injection from tool arguments The model may pass arguments derived from untrusted data. Never build a shell command, SQL query, f