The main security risks of an MCP server are confused deputy attacks on OAuth proxies, token passthrough, server-side request forgery, session hijacking, running untrusted local servers, and over-broad token scopes. The MCP specification names each one and gives a mitigation. Most of them come down to validating tokens, limiting privileges and asking a human before code runs.
Definitions in plain words
An MCP server exposes tools, resources and prompts to an AI application over the Model Context Protocol. An MCP client is the part of the AI application that connects to it. The model decides when to call a tool, so a server is a door that software can walk through without a person typing each request.
That is why the protocol's own security guidance reads like a list of ways a door can be misused.
The six risks at a glance
| Risk | What goes wrong | Main fix in the spec |
|---|---|---|
| Confused deputy | A proxy server with a static client ID lets an attacker reuse a consent cookie and collect an authorization code | Per-client consent before forwarding to the third party, exact redirect URI matching, state validation |
| Token passthrough | The server accepts a token not issued to it and forwards it downstream | Accept only tokens issued for the MCP server |
| SSRF | A malicious server points OAuth discovery URLs at internal addresses | HTTPS, block private and link-local ranges, validate redirects, use an egress proxy |
| Session hijacking | A guessed or stolen session ID is used to inject events or impersonate | Verify every request, never treat a session as authentication, use random IDs bound to the user |
| Local server compromise | A startup command or package runs arbitrary code with the client's privileges | Show the exact command, require consent, sandbox the process |
| Scope inflation | A stolen token carries broad scopes such as admin or wildcard | Start with minimal scopes and step up when needed |
How to review a server against the list
- Find out whether the server is local (stdio) or remote (HTTP). Local servers run as code on the machine. Remote servers are a network service with tokens.
- For a remote server, check that it validates the token audience and does not forward the client's token to other APIs.
- Look at the scopes it asks for. A scope list that includes wildcards is a warning sign.
- For a local server, read the exact launch command. Run it in a container or other sandbox with limited file and network access.
- Check that tool calls are visible to the user and can be denied. The tools section of the specification says there should always be a human in the loop with the ability to deny invocations.
- Confirm the server logs tool use and rate limits calls. The specification lists input validation, access control, rate limiting and output sanitization as things servers must do.
What a client should do too
Risk does not sit only on the server side. The specification asks clients to prompt for confirmation on sensitive operations, show tool inputs before calling the server so that data cannot leak quietly, validate results before passing them to the model, set timeouts and log tool usage. A well built server paired with a client that auto approves everything still leaves a gap.
Try it yourself
Click through it at your own pace, or open it full screen. Watch which step asks for a credential and which scope it requests.
Where Safeguard fits
Safeguard offers an MCP Guardrail and policies, gates and guardrails for agent activity, plus dependency scanning and SBOM generation for the packages an MCP server pulls in. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Is a local stdio MCP server safer than a remote one?
It depends on what you trust. A stdio server avoids network exposure, but it runs as code on your machine with the client's privileges. The specification recommends sandboxing local servers and showing the exact command before running it.
Does MCP require OAuth?
No. Authorization is optional in the specification. When an HTTP server supports it, the specification expects OAuth 2.1 based flows. For stdio servers it says to retrieve credentials from the environment instead.
Which risk is easiest to miss?
Token passthrough. A server can look correct and still accept any token it is handed. Check the audience validation explicitly.
Sources
Last reviewed: 19 October 2026.
