What are the security considerations for Model Context Protocol (MCP) servers per Anthropic's guidance?

Security considerations for Model Context Protocol (MCP) servers, according to Anthropic's guidance, primarily involve managing risks associated with untrusted servers, malicious inputs, and excessive permissions, as MCP is the layer where natural-language intent translates into real-world actions.

Concrete controls for MCP server security include:

• Token Management (MCP01:2025 Token Mismanagement & Secret Exposure): Use short-lived, narrowly-scoped, ephemeral OAuth tokens, never store secrets in server code or model context, reject token passthrough, and validate token audience binding.
• Privilege Management (MCP02:2025 Privilege Escalation via Scope Creep): Enforce least-privilege per server, use scoped credentials, set automated token/permission expiry, apply rate limits, and require human-in-the-loop confirmation for destructive operations. This also maps to OWASP LLM06:2025 Excessive Agency.
• Tool Integrity (MCP03:2025 Tool Poisoning): Inspect the full tool schema before approval, cryptographically pin or hash tool definitions, and re-verify them before execution, alerting on any post-approval changes.
• Supply Chain Security (MCP04:2025 Software Supply Chain Attacks & Dependency Tampering): Install servers only from verified sources, require code review and integrity verification via checksums or code signing, track an SBOM, and continuously monitor installed servers for malicious behavior. This maps to OWASP LLM03:2025 Supply Chain.
• Server Governance (MCP09:2025 Shadow MCP Servers): Maintain an approved-server allowlist enforced at an MCP gateway/proxy, verify server identity, block dynamic discovery/registration from untrusted networks, inventory and monitor all servers, and disallow default credentials. This maps to OWASP API9 Improper Inventory Management.
• Context Isolation (MCP10:2025 Context Injection & Over-Sharing): Strictly partition context per user, session, tenant, and task, apply field-level access controls and DLP scanning at the MCP proxy, minimize context to only what a tool needs, and isolate sensitive servers. This maps to OWASP LLM02:2025 Sensitive Information Disclosure.