The Security Best Practices of the official MCP specification are not a menu of options but concrete requirements. We translate them into a verifiable security architecture for your MCP-Servers and -Clients.
The Model Context Protocol (MCP) connects AI applications to Tools, data, and systems and thereby opens a new attack surface. The official MCP specification addresses this in its Security Best Practices (modelcontextprotocol.io, Rev. 2025-11-25) with concrete attack vectors and countermeasures; VamiSec organizes these into eight vectors and three groups. That the risks are real is demonstrated by documented incidents such as CVE-2025-6514 (CVSS 9.6, OS Command Injection via mcp-remote). In addition, the National Security Agency provides practical recommendations for production environments in its Cybersecurity Information Sheet (May 2026). We turn these requirements into a robust architecture rather than relying on the model to behave well.
The specification requires per-client consent before forwarding to third parties and an exact redirect_uri check by string match instead of wildcards; otherwise a Confused Deputy attack looms. The Token Passthrough prohibition applies as well: tokens that were not explicitly issued for your server must be rejected. Scopes are minimized according to the Least Privilege principle in order to keep the blast radius of a stolen token small.
Session IDs must never serve for authentication and must be generated non-deterministically (UUID, CSPRNG). Bind every session to the user, for example in the key format <user_id>:<session_id>, verify every incoming request, and rotate or expire IDs. This removes the basis for Session Hijacking and impersonation.
Tool descriptions and parameter schemas are an attack path in their own right (Tool Poisoning): if they are manipulated, the model carries out foreign instructions. Validate input parameters strictly against the schema and safeguard the provenance and integrity of the Tool definitions. The NSA guidance explicitly recommends validating parameters as well as signing and verifying MCP messages.
Local MCP-Servers run with the rights of the client; compromised code therefore hits your system directly. Containment belongs in the architecture: containers, chroot, or an app sandbox with minimal privileges, isolated child processes, and, where possible, the stdio transport. The NSA recommendation "Constrain and sandbox tool execution" is consistent with this requirement.
Without complete audit trails, exfiltration goes unnoticed and the attribution of actions breaks down. Log every action, including stdio usage, and analyze it for anomalies; the "Lethal Trifecta" (Simon Willison, 2025) should be checked per agent. The NSA identifies missing audit logs as a security problem in its own right and recommends instrumentation for logging and detection.
Integrate only verified MCP-Servers; a registry entry is not proof of trust. Consent dialogs must show the full startup command unabbreviated and flag dangerous patterns, and vulnerabilities must be tracked and patched on an ongoing basis. The NSA advises choosing supported MCP projects and avoiding weak approval workflows ("Poor approval workflows").
The content on this page is based on the following publicly available guides and studies.
Official part of the MCP specification, Rev. 2025-11-25; describes attack vectors and countermeasures (including Confused Deputy, Token Passthrough, SSRF, Session Hijacking). The grouping into eight vectors and three groups is VamiSec's own treatment.
May 2026, Ver. 1.0 (U/OO/6030316-26, PP-26-1834). Practical recommendations for production environments: validate parameters, sandbox Tool execution, sign and verify MCP messages, logging and detection.
Mental model: access to private data, unverified content, and external communication together form an exfiltration path. Used as an assessment grid per agent.
CVSS 9.6; OS Command Injection via mcp-remote when connecting to malicious MCP-Servers (July 2025). Demonstrates the practical relevance of the specification's requirements.
VamiSec evaluates your MCP-Servers and -Clients against the official specification and the NSA guidance - from OAuth authorization through Sandboxing to logging. Assessment, penetration test, or webinar: get in touch.
