Model Context Protocol: Build Production-Ready AI Integrations

4. Security, Permissions, and Trust

Build MCP systems that respect user intent, protect credentials, and reduce unsafe model actions.

4.1 – MCP Threat Model (link to this section)

Understand security risks introduced when models can access tools and data through MCP.

MCP Threat Model

Goal

Identify the attack surfaces introduced by model-tool connectivity.

Risks

  • Prompt injection from untrusted content.
  • Data exfiltration through overly broad resources.
  • Tool misuse or unintended side effects.
  • Confused deputy problems.
  • Credential leakage in logs or outputs.
  • Supply-chain risk from third-party servers.

Exercise

Draw a threat model for your mini project and mark trust boundaries.

4.2 – Authentication and Authorization (link to this section)

Design authentication and authorization flows for MCP servers and connected systems.

Authentication and Authorization

Goal

Design identity and access control for MCP systems.

Decisions

  • Is the server acting as the user, a service, or both?
  • Which scopes are required for each tool?
  • Where are secrets stored and rotated?
  • How are sessions established and expired?
  • How are authorization failures communicated?

Assignment

Create a permission table mapping each tool to required user role, scopes, and data boundaries.

4.3 – Permission Boundaries and Human-in-the-Loop Controls (link to this section)

Decide which actions should be automatic, which need confirmation, and which should not be exposed.

Permission Boundaries and Human-in-the-Loop Controls

Goal

Decide what should be automatic, confirmed, or forbidden.

Permission ladder

Read-only actions are usually safest. Draft operations prepare changes. Commit operations change real systems and often require user confirmation. Destructive or irreversible actions may be excluded entirely.

Controls

  • Dry runs.
  • Confirmation tokens.
  • Reversible operations.
  • Policy checks.
  • Clear summaries before commit.

Exercise

Classify every tool in your project on the permission ladder.

4.4 – Prompt Injection and Untrusted Data (link to this section)

Learn how untrusted data can manipulate AI behavior and how MCP servers can reduce blast radius.

Prompt Injection and Untrusted Data

Goal

Reduce the blast radius of malicious or misleading content.

Tool and resource outputs can contain instructions that conflict with the user or system. Treat external content as data, not authority.

Mitigations

  • Least-privilege tools and tokens.
  • Output labeling and sanitization.
  • Separation between instructions and retrieved content.
  • Confirmation for risky actions.
  • Quarantine suspicious content.

Exercise

Write a test case where a resource tries to trick the assistant into exfiltrating data.

4.5 – Logging, Auditing, and Compliance (link to this section)

Make MCP interactions traceable for debugging, compliance, and operational review.

Logging, Auditing, and Compliance

Goal

Make MCP activity traceable without leaking sensitive data.

Log

  • Tool name, timestamp, user/session, status, latency.
  • Permission decision and policy version.
  • External request identifiers.
  • Redacted parameters and outputs when appropriate.

Avoid logging

Secrets, tokens, full sensitive records, or unnecessary prompt contents.

Assignment

Design an audit event schema for tool invocations.

4.6 – Security Review Workshop (link to this section)

Review an MCP server design and identify security flaws before production deployment.

Security Review Workshop

Goal

Review an MCP server before production.

Deliverables

  • Threat model with trust boundaries.
  • Tool permission matrix.
  • Secret handling plan.
  • Logging and redaction plan.
  • Prompt injection test cases.
  • Human-confirmation rules.

Workshop format

Pair-review another learner's design, identify the top three risks, and recommend concrete mitigations before launch.

Practise this chapter in the workspace

Reading is the map. Every section above also runs as a hands-on workspace session with tools, exercises and a recap quiz.

Start Learning for Free