What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Model Context Protocol (MCP) is a standard way for an AI application to discover and use capabilities provided by external servers, such as data resources, prompts, and tools. It standardizes how clients and servers communicate; it does not certify that a connected tool is safe, that its output is trustworthy, or that its access is appropriately limited. Security depends on controls at the client, transport, server, and downstream-service boundaries.
What MCP standardizes
MCP is an open client-server protocol for connecting AI applications to external context and actions. A server can expose resources, prompts, and tools; a client can discover and interact with them through protocol messages. In practical terms, MCP standardizes the connection and exchange of messages, not the correctness, permissions, or safety of every capability behind that connection. The definition and behavior described here follow the Model Context Protocol Basic Specification, version 2026-07-28.
As an Amazon Associate I earn from qualifying purchases.
The same specification describes MCP as stateless: “The Model Context Protocol (MCP) is a stateless protocol: all the information needed to process a request is contained in the request itself.” A server must not infer a client’s identity, capabilities, or conversation context from earlier requests merely because they arrived over the same connection. If processing depends on state, that state must be explicitly identified and supplied. A long-running STDIO process or open network stream is therefore not, by itself, a reliable identity or conversation boundary.
Stateless protocol processing does not mean an application has no persistent state. A host, client, server, or downstream service may maintain state, but its identity, scope, lifetime, and isolation must be designed explicitly rather than assumed from a connection.
#1 Best Overall
Where the security boundaries sit
1. The client, model, and user-approval boundary
The MCP client sits between the AI application and servers. It discovers capabilities and mediates requests, but the protocol does not make the model’s choice of a tool safe. Tool descriptions and returned content are inputs to the application, not enforcement mechanisms. The client or host must decide which actions are allowed, which require user approval, and how untrusted instructions or content are handled.
The NSA’s May 2026 Model Context Protocol (MCP): Security Design Considerations identifies risks including overly broad tool privileges and sensitive information moving through tool workflows. These are deployment concerns, not evidence that every MCP implementation has the same weakness.
2. The transport and authentication boundary
Authorization is optional across MCP implementations; it is not a protocol-wide requirement for every connection. The published MCP authorization profile applies to HTTP-based transports. For STDIO, the authorization specification directs implementations to obtain credentials from the environment; other transports should use their established security practices.
| Transport | Authorization approach in the MCP specification | Security implication |
|---|---|---|
| HTTP-based | The published MCP authorization profile defines authorization for protected servers, including resource discovery and token use. | Apply the HTTP profile’s resource and token protections; do not assume that establishing an HTTP connection authenticates or authorizes a user. |
| STDIO | The authorization specification says implementations should obtain credentials from the environment rather than applying the HTTP OAuth flow. | Protect the process environment and credential handling. A persistent process does not itself establish user identity or conversation scope. |
For protected HTTP servers, the authorization specification and its security considerations describe controls including resource-specific tokens and server-side audience validation. A token’s audience identifies the service for which it was issued: an MCP server must reject a token intended for a different resource. The server must also not forward the token it received from an MCP client when making an upstream API request.
Rank #3
The current security considerations also address secure token storage, HTTPS for authorization endpoints, PKCE for authorization-code flows, exact redirect URI validation, and defenses against issuer mix-ups and confused-deputy behavior. Authorization servers should issue short-lived access tokens; public clients must rotate refresh tokens under the referenced OAuth requirements. These are protections for the authorization flow, not proof that an authorized request is harmless.
3. The server and tool-permission boundary
A server’s authorization check answers whether a caller may access the server; application policy must still determine which tools that caller may use and what each tool may do. Server operators need to define the identity under which a tool acts, validate its inputs, and constrain its access to data and external services. Tool names, descriptions, and annotations can communicate intent, but they do not replace permission checks.
Where practical, give tools only the permissions they need, separate read operations from write or destructive actions, and require appropriate approval for consequential changes. Validate outputs as well as inputs, particularly before passing returned content into later model or tool steps. These are operational safeguards; MCP does not automatically enforce least privilege or user confirmation.
4. The downstream-service and data boundary
An MCP server often acts as an intermediary to another API or data source. Use credentials scoped for that downstream service rather than reusing the MCP client’s token. Map the user’s identity and consent deliberately, and make authorization decisions specific to both the principal and the resource being accessed. Otherwise, a server may unintentionally act with broader authority than the user intended—the confused-deputy risk called out in the MCP security considerations.
Best Value
Isolation also remains an operator responsibility. Decide how users, tasks, conversations, and sensitive data are separated across the client, server, and downstream systems. The NSA’s May 2026 guidance discusses token and session risks, task and data isolation weaknesses, implementation inconsistency, and overly broad privileges as design concerns; it does not establish that all deployments exhibit them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical security review
Review the deployment as a chain of distinct trust boundaries rather than treating “MCP is authorized” as a complete security result:
- Identify the transport. Record whether each connection uses HTTP or STDIO and apply the corresponding credential model. Do not apply the HTTP OAuth profile indiscriminately to STDIO.
- For protected HTTP, identify the resource. Use resource metadata discovery and request a token for the intended MCP server.
- Validate tokens at the server. Check the audience and reject tokens issued for another resource. Do not pass the MCP client’s token through to an upstream API.
- Harden authorization handling. Protect tokens in storage and logs; use HTTPS, PKCE, exact registered redirect URIs, and issuer and mix-up validation as required by the current specification.
- Constrain each tool. Grant minimum permissions, separate read and write capabilities where practical, validate inputs and outputs, isolate sensitive data, and gate consequential actions with an appropriate approval policy.
- Check operational readiness. Track implementation and dependency vulnerabilities, monitor relevant activity, and review token lifecycle and revocation behavior for the systems in use.
- Verify version compatibility. Confirm which MCP specification version and SDK behavior the deployed client and server support; do not assume that matching protocol names guarantee matching security behavior.
What changed in the 2026-07-28 specification
The MCP project’s 2026-07-28 release describes a stateless core, an extensions framework, Tasks and MCP Apps as extensions, authorization hardening, and a formal deprecation policy. Because implementations may support different versions, treat these as version-specific project status and check the version actually supported by each endpoint.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The release notes formally deprecate Dynamic Client Registration (DCR) in favor of Client ID Metadata Documents. DCR remains for backward compatibility and is planned for removal in a future specification version. The same release notes mark Roots, Sampling, Logging, and legacy HTTP+SSE as deprecated and describe an offramp. These changes make version and feature compatibility part of deployment security: identify dependencies on deprecated behavior and plan migration according to the release notes.
Is MCP secure?
MCP provides a defined way for AI applications and servers to exchange requests and capabilities, and its HTTP authorization profile specifies important protections for protected HTTP deployments. Neither the protocol nor transport authorization makes every connected component trustworthy. A sound security design separately controls what the client permits, what each server and tool can do, which credentials cross each boundary, how downstream access is scoped, and how state and sensitive data are isolated. The right review target is the complete workflow, not just whether an MCP connection has an authorization mechanism.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
