Short answers to what readers ask most about this topic.
A field checklist for hardening MCP servers: token audience validation, SSRF and session defenses, stdio and HTTP transport risks, and supply-chain threats.
Matthews Wong
Software Engineer
Key Takeaway
An MCP server exposes tools and data to AI clients, so it is an attack surface. This checklist covers the essentials: validate token audience to avoid token passthrough, generate unguessable session IDs, block SSRF on HTTP transports, sanitize stdio input, and pin tool definitions against poisoning and rug-pull swaps.
The Model Context Protocol lets an AI client call your tools and read your data through a small server. That convenience is also a liability: every primitive you expose is something an attacker can try to reach through the model. An MCP server is production software, and it deserves the same threat modeling you would give any public API.
This checklist pulls together the guidance in the MCP specification with recent findings from the Cloud Security Alliance and OWASP. Work through it before you connect a server to real credentials or ship it to a marketplace. The items run from the highest-impact controls down to operational hygiene.
If you do nothing else, do these. Each item closes a hole that has been exploited in real MCP deployments, and none of them requires exotic tooling.
Treat this as a pre-flight list and confirm every line before your server touches a real token or a real user's data:
Most serious MCP incidents start at the auth boundary. A server that accepts any bearer token, or that forwards a token it received to a downstream API, hands an attacker a way to borrow someone else's authority. The specification is blunt about this: a server must only accept tokens minted for itself, and must not pass tokens through to other services.
When your server sits in front of an OAuth provider it can become a confused deputy that acts with more privilege than the caller should have. The fix is consent and audience checks, enforced at the edge. A minimal hardening profile for a Streamable HTTP server looks like this:
# Streamable HTTP MCP server hardening (env)
BIND_ADDRESS=127.0.0.1 # never 0.0.0.0 on a shared host
ALLOWED_ORIGINS=https://app.example.com
REQUIRE_AUTH=true # close the optional-auth gap
TOKEN_AUDIENCE=mcp.example.com # reject tokens minted for anything else
BLOCK_INTERNAL_IPS=169.254.169.254,127.0.0.1,::1 # stop SSRF to metadataClose the optional-auth gap early. According to the Cloud Security Alliance, many MCP servers ship with authentication left optional, so a server that is safe on your laptop becomes wide open the moment it is exposed on a network. Make auth mandatory and fail closed.
The two common transports fail in different ways, so the controls differ too. Know which one you are running and defend it accordingly.
The tools an MCP server advertises are instructions the model will trust, and that trust is the attack surface. In a tool-poisoning attack a description carries hidden instructions; in a rug-pull a server behaves well during review and swaps in malicious behavior later.
According to OWASP GenAI's Q1 2026 exploit round-up, prompt-injection and tool-poisoning techniques against agent tooling are being actively catalogued, not treated as theoretical. Handle any third-party MCP server the way you would an unvetted dependency: pin its version, review its tool definitions, and re-review on update.
Beware the lethal trifecta. A server that combines access to private data, exposure to untrusted content, and the ability to make outbound requests can be turned into an exfiltration channel through prompt injection alone. If you cannot remove one of the three, isolate the server hard.
The last layer is the boring one that saves you at 3 a.m. These controls do not stop a specific exploit; they limit blast radius and make incidents visible.
MCP security is not exotic; it is ordinary application security applied to a new kind of caller. Validate tokens, bind sessions, guard your transport, distrust third-party tools, and log everything. Run this checklist once before launch and again on every dependency bump, and most of the MCP crisis headlines stop being about you.