MCP Server Security and Access Control

MCP server access for AI agent web data needs more than a working connection. Olostep provides search, scraping, and URL discovery/crawling through MCP, with Markdown, HTML, or JSON outputs. This guide to MCP server security and access control explains the engineering those connections require, namely verified identity, scoped tool permissions, tool integrity checks, and runtime monitoring at every trust boundary.

Why MCP's protocol-level security gap is an active engineering problem, not a configuration oversight

MCP’s security omissions are deliberate design-scope decisions. The protocol sets a standard for tool discovery and calls, but implementers must build authentication, authorization, and transport security into their systems. Its per-request OAuth token validation requirement does not supply a fully verifiable identity across multiple delegation hops.

Wiz Research found MCP servers in a large share of the cloud environments it observed in early 2026, including some with internet-facing servers. That makes the gap an exposed engineering problem now. Statelessness also moves state from session headers into ordinary tool arguments, where forged or reused handles need explicit validation. Watching the old header is rather like guarding a door after the wall has moved.

The trust-boundary model that makes MCP fundamentally different from a traditional API

A fixed toolset lets a team define its boundaries at deployment. MCP instead lets an agent discover tools at runtime from reachable servers, each introducing a boundary the identity system does not automatically understand. The model’s attention mechanism does not distinguish trusted tool text from attacker-controlled text. Both go into the context window alongside the system prompt and conversation history.

Wiz Research calls the dangerous combination of untrusted input, sensitive data access, and permission to act the “lethal trifecta”. Sharing context adds another problem, because details about the environment, past interactions, and available capabilities can end up with the wrong tool or in insecure logs. An MCP integration using Olostep to crawl and process live data, for example, still crosses this boundary when external content returns to the agent. If that content contains malicious instructions, the integration can become a route for context leakage. Because one server commonly holds credentials for several downstream systems, the security model must cover a multi-hop trust chain.

The five attack vectors that define the current threat landscape, and the mechanism behind each

Tool poisoning puts malicious instructions inside tool metadata, so they enter the model’s context at session start. The poison persists across sessions without repeated attacker action. Invariant Labs demonstrated this in April 2025 with a poisoned math tool that read SSH keys and exfiltrated them inside an encoded math-function parameter. What looked like a calculation was carrying rather more than arithmetic.

The confused deputy attack turns a proxy’s broad authority against its users. The MCP specification describes a proxy using a static client ID with a third-party authorization server while accepting dynamically registered MCP clients. A consent cookie from a legitimate flow lets a malicious request skip consent and redirect the authorization code to an attacker-controlled URI. The proxy has authority, but exercises it for the wrong party.

Token passthrough breaks a different boundary by forwarding an upstream token into downstream tool calls. A credential issued for one audience then reaches systems it was never meant to touch. The authorization specification forbids this practice. OAuth 2.0 token exchange per RFC 8693 or vaulted credentials provide the required alternative.

Indirect prompt injection comes in through tool results. An honest server can fetch malicious instructions from a database, API, or webpage and return them directly into the agent’s context. For MCP servers fetching live web content, this is the highest-volume attack surface. Reviewing the server cannot establish the trustworthiness of everything it retrieves.

Supply chain compromise brings in rogue behavior through a package or an update. In the Postmark MCP incident in September 2025, an update to an email package silently sent a copy of every email the agent sent to an attacker-controlled domain. Its legitimate behavior at installation had allowed it to pass standard review. Approval of one version did not establish the integrity of the next.

What recent incidents reveal about which defenses actually fail in production

Dolt MCP’s August 2026 authentication bypass affected versions 0.3.1–0.3.6 and was fixed in 0.3.7. Invalid tokens got a 401 response, but processing went on, and session validation accepted IDs that the attacker had generated. An unauthenticated caller could therefore run database tools with server credentials. A rejection message that does not stop the call is a greeting card with a security theme.

Grafana MCP’s August 2026 flaws show why session binding and egress validation need separate controls. The server accepted well-formed caller-generated session IDs, allowing callers to list and run tools with its Grafana service account. A separate caller-controlled header could redirect requests to cloud metadata endpoints. CVE-2026-19516 carried a CVSS score of 9.1 and was fixed in mcp-grafana 1.1.0.

The Deadbugz campaign in August 2026 exposed the limits of initial approval. Its malicious “productivity-suite” server spread through public GitHub pull requests and changed instructions after three ordinary tool calls. It then directed agents to find SSH keys, AWS credentials, shell history, and Kubernetes configuration while concealing the activity.

Agentjacking via Sentry MCP in June 2026 affected organizations with injectable DSNs and achieved a high agent execution rate in testing. Sentry declined remediation and deployed a payload-string filter, leaving structural authorization unresolved. The MCP Python SDK OAuth flaw in September 2026 left another boundary open by letting a malicious server get a client secret, authorization code, and PKCE proof key. Fixes arrived in versions 1.30.0 and 2.2.0. Together, these cases prioritize hard authentication stops, bound sessions, constrained authority, redirect validation, and approval that extends beyond installation.

OAuth 2.1, PKCE, and audience-bound tokens as the identity foundation every MCP deployment needs

OAuth 2.1 with PKCE and audience-bound tokens provides the identity baseline. The June 2025 specification formalized MCP servers as OAuth 2.0 resource servers, and the July 2026 revision hardened that model. Each request must carry its own identity and version metadata and go through authorization on its own. A token intended for one server must not work against another.

The July 2026 revision also deprecated Dynamic Client Registration (DCR) in favor of Client ID Metadata Documents (CIMD). DCR remains for backward compatibility but is scheduled for removal, so implementers should prefer CIMD now. Client credentials are bound to the authorization server that issued them, and clients must re-register if that server changes. Enterprise deployments should use Enterprise-Managed Authorization (EMA), which was added through the revision’s formal extensions framework.

Proxy consent must bind the user’s decision to the specific client_id. Keep the approved client_id values for each user and check them before starting third-party authorization. The consent interface must identify the requesting client, requested API scopes, and registered redirect_uri, with CSRF protection and protection against iframing. Redirect validation requires exact string matching. Generate cryptographically secure random OAuth state for each request, store it server-side only after explicit consent, and validate it at callback.

Scoping tool permissions so that a compromised server cannot reach across trust boundaries

Authentication establishes who is calling, while scoping limits the damage that caller can cause. Apply least privilege to each tool instead of giving permission for the server’s whole toolset as one bundle. A read-only file tool and a shell execution tool should not share spanning credentials unless the use case requires it. Microsoft identifies full mailbox access where read-only access would suffice as a common misconfiguration.

Sensitive servers also need separation from general-purpose ones, with additional authorization at the boundary. Enforce scopes on every tool invocation after the OAuth grant, because a broad grant does not license every available tool. Keep credentials in a vault and exchange them server-side, never in descriptions, schemas, or return values visible to the model.

Stateless web data APIs handling batches across thousands of URLs offer a useful architectural parallel for integrations such as Olostep. Identity and scoped permissions need to travel with each request independently of session headers. Apply that rigor to MCP tool calls by validating handles at every invocation. Otherwise, handle forgery, weak scoping, and cross-tenant reuse can reopen boundaries that token checks appeared to close.

Tool integrity validation before any tool description enters the model's context

Invocation-time authorization comes too late to prevent malicious metadata from entering the model’s context. Treat every tool description, parameter schema, and server as untrusted until human approval. Microsoft recommends showing the full schema rather than a friendly summary, and keeping the full tool call in view while it runs. The friendly summary is not where the unfriendly instructions necessarily live.

Pin server versions and verify package checksums and provenance attestations before deployment. Treat an unreviewed update as a new unreviewed server, because Postmark’s malicious behavior arrived after installation. Distinguish internal, audited servers from community or external servers in configuration to reduce naming collisions and typosquatting. For web research and data pipelines, output validation and sanitization are separate controls because the result itself is an injection surface.

Runtime observability and audit logging as the detection layer that catches what prevention missed

Deadbugz demonstrates why approval needs a runtime counterpart. Monitoring catches changes after deployment that identity checks and a review at the start cannot rule out. Every invocation should produce a structured log containing the authenticated identity, tool name, server, full arguments, and timestamp. Capture what the tool returned as well, at enough detail to reconstruct the agent’s action sequence and locate an injection point.

Alert when a narrow-purpose tool starts requesting credentials, accessing file paths, or contacting external endpoints it has not previously touched. These deviations warrant investigation even when the caller’s token is valid. The stateless request model gives a gateway identity and metadata to inspect on each call independently of a hidden session. Record tool-call arguments without copying the full context window, and protect the stored logs with the same access controls as the systems those tools reach.

The enterprise MCP gateway as the control plane that enforces all of this at one chokepoint

An identity-aware gateway makes these layers practical at production scale. Positioned between agents and tool servers, it centralizes OAuth enforcement, scope checks, tool-call logging, and rate limiting. It also gives approved-tool controls one shared place to run, so each server does not have to build the same machinery. Centralized deployments still require server-side restraint.

IBM ContextForge is an open-source registry and proxy that federates MCP servers, A2A agents, and REST or gRPC APIs into one endpoint. It exports OpenTelemetry traces to OTLP backends. Lunar.dev MCPX focuses on centralized governance, access control, and auditability for agent-to-tool interactions. Amazon Bedrock AgentCore Gateway and Microsoft’s Azure-based MCP gateway offer options for cloud-committed organizations. Azure API Management can validate Microsoft Entra token issuer, audience, client application ID, and required scope before requests reach tools.

For live web data, output inspection and egress validation belong at this enforcement point too. Olostep supplies search, scraping, and URL discovery/crawling through a structured API, making it a web-data source behind the gateway. Clean Markdown or JSON can reduce the injection surface compared with piping raw HTML directly into context, but formatting does not establish trust. Its HTML output likewise requires inspection. A gateway unifies the audit trail, while per-server credential limits still contain the damage if an integration is compromised.

A phased implementation sequence for teams moving from no controls to production-ready MCP security

Start with the identity baseline because later controls depend on knowing who made each request. Phase 1 establishes OAuth 2.1 with PKCE, audience-bound tokens, CIMD, per-client consent, and exact redirect matching. Check SDK versions against the OAuth flaw fixes before relying on that foundation. Identity built on vulnerable credential handling is not much of a foundation.

Phase 2 narrows scopes to each tool’s minimum, moves credentials into a vault, separates sensitive servers, and validates handles per invocation. Once the reachable damage is constrained, Phase 3 adds human approval for servers and updates, version pinning, package integrity checks, and external-output sanitization.

Phase 4 adds structured logging for each call, alerts for changes in behavior, and protection for the stored logs. Phase 5 routes agent-to-tool traffic through an identity-aware gateway for centralized authentication, scope enforcement, rate limiting, and auditing. The Cloud Security Alliance’s four-level maturity model supports adding controls in this order to cover more of the risks. Revisit those controls at each MCP specification revision, because protocol changes can move the boundary a previous implementation protected. MCP security is ongoing engineering work.