To secure an MCP server, verify that each request is authorized for that server, grant tools only the access they need, and isolate each execution environment according to what it can reach. Start by identifying whether your server uses stdio, localhost HTTP, or remote HTTP; then apply the controls below at the client, server, identity, downstream API, and runtime boundaries. This checklist draws on the MCP Security Best Practices documentation published under the 2025-11-25 specification path, the 2026-07-28 specification release, and the TypeScript SDK v1 documentation. Those materials do not make every recommendation in the dated security guide a normative requirement of the newer specification.
MCP security checklist: identify the trust boundaries first
Before reviewing individual controls, map where requests, credentials, data, and executable code cross a boundary. Note whether tools read sensitive data, perform writes, call third-party APIs, or accept user-controlled arguments. If an MCP App displays server-provided UI, include the app host and its iframe in the map as well.
As an Amazon Associate I earn from qualifying purchases.
| Deployment or component | Security boundary to assess |
|---|---|
| Local server over stdio | The client launches a process; assess its operating-system permissions, filesystem access, and ability to run commands or make network requests. |
| HTTP server on localhost | Assess HTTP authentication and local network exposure, including DNS rebinding risks. Binding to loopback and binding to all interfaces have different exposure. |
| Remote HTTP server | Assess token validation, authorization challenges, session identity, network egress, and any OAuth discovery or redirect flow. |
| Downstream API | Assess whether the MCP server uses its own appropriately scoped credential and independently checks the caller’s permission for each operation and object. |
| MCP App UI | Assess the sandboxed iframe, host-mediated tool approvals, message handling, and declared network origins separately from the server process. |
MCP authentication and authorization: validate the request at the HTTP boundary
Verify that a token is valid for this MCP server
For protected HTTP endpoints, use a trusted token verifier and validate the token’s issuer, expiry, and relevant authorization claims. Also verify that the token was issued for the MCP server or resource receiving it. A syntactically valid bearer token—or a token issued for a different API—is not sufficient. The MCP Security Best Practices document states: “MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server.”
The TypeScript SDK v1 server documentation describes the expectedResource setting: when configured, a token for a different resource, or one with no resource, is rejected with 401 invalid_token. Treat that as an SDK-specific documented control, not as a claim about every SDK or deployment.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Challenge for authorization before running protected tools
For a protected remote resource, return HTTP 401 with a WWW-Authenticate challenge so the client can follow the documented authorization and OAuth discovery flow. Do not substitute a tool-level error for the HTTP authorization challenge when the request itself lacks authorization. The MCP Apps Authorization guide describes per-server authorization, which gates every request, and per-tool authorization, which can leave public tools available while protecting sensitive ones.
Keep upstream credentials out of pass-through flows
Do not forward a client’s access token to a downstream API as a proxy credential. Validate the client’s token for the MCP resource, then use a separately controlled downstream credential or authorization flow appropriate to the operation. Token passthrough is identified as an anti-pattern in the MCP Security Best Practices guidance.
Apply least privilege at both the scope and tool levels
Request only the baseline access needed
Begin with a small set of scopes and request additional access only when a user invokes an operation that needs it. Use precise authorization challenges for that elevation. Avoid wildcard scopes and broad names such as all or full-access; do not publish every possible scope or treat the presence of a token claim as proof that a particular action is allowed.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Authorize the specific operation and object
Separate read, write, administrative, and unrelated data privileges. In each protected tool handler, check that the authenticated caller may perform the requested operation and access the specific referenced object. Do not rely on a user ID, account ID, or ownership claim supplied only as a tool argument. Scope returned data to the authenticated user.
Make elevation understandable and auditable
Explain a consent request in terms of the action or data the user recognizes, rather than presenting unexplained scope names. Where the deployment requires audit records, log scope elevation details with correlation IDs, as recommended by the security guidance.
Sandbox the code that actually needs isolation
Constrain local stdio processes
A stdio server runs as a local process, so an iframe sandbox offers it no protection. Restrict the process’s filesystem access and operating-system permissions; use process isolation or a container where appropriate; and require additional authorization for dangerous commands. The MCP Security Best Practices guidance presents these as SHOULD-style controls for locally spawned servers or proxies, rather than as universal requirements for every deployment.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Constrain MCP App UI separately
MCP Apps use sandboxed iframes to restrict UI access to the host. Use the documented sandbox model, predeclared templates, auditable messages, and host-controlled approval for UI-initiated tool calls. Declare the app’s network origins in its CSP metadata: connection targets and resource origins are distinct declarations, and the documented model blocks unspecified external connections. These iframe controls isolate UI code; they do not isolate a local executable or remote MCP server.
Protect localhost, discovery, and network egress
Harden localhost HTTP servers against DNS rebinding
A service that is intended only for local use can still face DNS rebinding risks. The TypeScript SDK v1 server guide documents protections in createMcpExpressApp() for localhost and loopback configurations. It also warns that binding to 0.0.0.0 does not automatically enable that protection. Confirm the actual bind address and protections rather than assuming a local development server is unreachable from other interfaces.
Prevent OAuth discovery from becoming an SSRF path
Authorization metadata discovery can cause a client to fetch attacker-controlled URLs. The MCP Go SDK LifeCycle documentation describes HTTPS enforcement, rejection of private and link-local destinations, redirect validation, and DNS-rebinding-aware checks. A custom HTTP transport can bypass some of those defaults, leaving the caller responsible for equivalent protections.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Control server-side requests and redirects
Validate redirect targets and do not blindly follow redirects to internal resources. Where the threat model warrants it, add network egress controls such as an egress proxy or network policy for server-side clients. These controls reduce the impact of a compromised tool, unsafe URL handling, or a downstream request path that reaches unintended destinations.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Secure sessions and OAuth flows
Authenticate every request, not just the session setup
Verify authorization on every inbound request. A session ID is not proof of identity: use secure, unpredictable session identifiers and bind a session to the authenticated user when applicable. Apply authorization checks even when a request presents an existing session.
Validate OAuth state, redirects, and issuer
Use secure random, single-use OAuth state values and require exact redirect URI matching. The MCP release announcement for specification version 2026-07-28 says clients must validate the authorization response iss parameter in accordance with RFC 9207. Keep that issuer check in the client authorization flow rather than treating successful redirection alone as proof of the expected authorization server.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check version-specific behavior before deployment
MCP security and authorization details evolve. The Security Best Practices document is under the 2025-11-25 specification documentation path; the release announcement describes specification version 2026-07-28. The TypeScript server documentation identifies itself as SDK v1, while the retrieved Go SDK LifeCycle page does not state a version. Check the documentation for the exact specification and SDK versions you deploy, especially where a dated guide and newer authorization behavior may differ.
The 2026-07-28 release announcement describes RFC 9207 issuer validation and a shift in preferred client-registration direction toward client metadata documents. Separately, the MCP roadmap discusses agent identity, proof-of-possession adoption, workload identity federation, and delegation as development priorities. Treat roadmap items as future direction, not as controls already released or settled requirements.
Quick Recap
Go-live review
- Confirm each HTTP token is valid, intended for this MCP resource, and checked for the claims required by the operation.
- Confirm protected HTTP resources issue the expected authorization challenge and sensitive handlers enforce authorization independently.
- Review scopes and tool permissions for unnecessary breadth, and test access to objects belonging to other users.
- Verify local process restrictions, app iframe controls, and network-origin declarations apply to the correct execution context.
- Test localhost exposure, metadata URL handling, redirect validation, and egress restrictions against the actual SDK and transport configuration.
- Confirm authorization is checked on every request and that sessions are tied to authenticated identities where applicable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
