{ "title": "MCP Security — Reader FAQ", "schemaVersion": "1.0", "researchFreeze": "2026-08-25", "protocolRevision": "2026-07-28", "publicationNote": "All 50 answers are rendered visibly on the MCP security cornerstone; this endpoint does not imply search-result eligibility.", "count": 50, "records": [ { "id": "R4-FAQ01", "question": "What is MCP security?", "answer": "MCP security is the protection of the full host–client–server system, including protocol handling, SDKs, packages, authorization, deployment, model behavior and the underlying service.", "verified": "2026-08-25" }, { "id": "R4-FAQ02", "question": "Is MCP secure?", "answer": "MCP has security requirements and guidance, but compliance alone is not a guarantee. Security depends on the implementation and deployment.", "verified": "2026-08-25" }, { "id": "R4-FAQ03", "question": "Is MCP insecure by design?", "answer": "No single yes-or-no label is technically adequate. MCP creates a capability boundary and new trust relationships; those can be secured well or poorly.", "verified": "2026-08-25" }, { "id": "R4-FAQ04", "question": "Does MCP require authentication?", "answer": "No. Current MCP authorization is optional. Network exposure must match the intended public or restricted use case.", "verified": "2026-08-25" }, { "id": "R4-FAQ05", "question": "Does MCP use OAuth?", "answer": "HTTP-based deployments that support authorization should follow the MCP OAuth profile. stdio deployments should not use that browser-oriented flow.", "verified": "2026-08-25" }, { "id": "R4-FAQ06", "question": "Is OAuth authentication or authorization?", "answer": "OAuth is primarily an authorization framework. Identity may be established through OpenID Connect or another authentication system.", "verified": "2026-08-25" }, { "id": "R4-FAQ07", "question": "What is an MCP resource server?", "answer": "In the OAuth profile, the protected MCP server is the resource server that accepts audience-bound access tokens.", "verified": "2026-08-25" }, { "id": "R4-FAQ08", "question": "What is protected-resource metadata?", "answer": "It is RFC 9728 metadata through which the MCP server identifies its authorization servers and relevant authorization information.", "verified": "2026-08-25" }, { "id": "R4-FAQ09", "question": "What are Resource Indicators?", "answer": "RFC 8707 Resource Indicators identify the target MCP server in authorization and token requests so tokens can be audience-bound.", "verified": "2026-08-25" }, { "id": "R4-FAQ10", "question": "What is PKCE?", "answer": "Proof Key for Code Exchange binds an authorization request to the client that later redeems the code, protecting public clients from code interception.", "verified": "2026-08-25" }, { "id": "R4-FAQ11", "question": "What is Client ID Metadata Documents in MCP?", "answer": "CIMD lets a client use a verifiable HTTPS URL as its client identifier and metadata source. Current MCP prefers it over Dynamic Client Registration.", "verified": "2026-08-25" }, { "id": "R4-FAQ12", "question": "Why was Dynamic Client Registration deprecated?", "answer": "The open-client ecosystem made secure dynamic registration difficult; current MCP prefers CIMD while retaining DCR for backward compatibility.", "verified": "2026-08-25" }, { "id": "R4-FAQ13", "question": "What is token passthrough?", "answer": "It is forwarding a token received from an MCP client to another service. This breaks audience separation and is prohibited by official guidance.", "verified": "2026-08-25" }, { "id": "R4-FAQ14", "question": "What is a confused-deputy attack in MCP?", "answer": "A privileged server or OAuth proxy is tricked into using its authority for an attacker’s objective because user consent, client, issuer or target resource was not bound correctly.", "verified": "2026-08-25" }, { "id": "R4-FAQ15", "question": "Can MCP metadata discovery cause SSRF?", "answer": "Yes, if an implementation fetches attacker-controlled metadata or authorization URLs without egress and address validation.", "verified": "2026-08-25" }, { "id": "R4-FAQ16", "question": "Are local MCP servers safe?", "answer": "They avoid many network risks but can execute code with local authority, read files and inherit secrets.", "verified": "2026-08-25" }, { "id": "R4-FAQ17", "question": "Are remote MCP servers safe?", "answer": "They can be operated securely, but they require network authentication, authorization, tenant isolation, secure routing, rate limits and operational controls.", "verified": "2026-08-25" }, { "id": "R4-FAQ18", "question": "Is stdio secure?", "answer": "stdio avoids a listening network endpoint. It does not make the launched process trustworthy or limit its OS permissions.", "verified": "2026-08-25" }, { "id": "R4-FAQ19", "question": "Can a website attack a localhost MCP server?", "answer": "Under specific conditions, yes. DNS rebinding advisories affected unauthenticated local HTTP deployments with insufficient Host validation.", "verified": "2026-08-25" }, { "id": "R4-FAQ20", "question": "Does DNS rebinding affect stdio?", "answer": "The official TypeScript SDK advisory explicitly stated that its DNS-rebinding issue did not affect stdio.", "verified": "2026-08-25" }, { "id": "R4-FAQ21", "question": "What is tool poisoning?", "answer": "Tool poisoning embeds attacker instructions in tool descriptions or schema text consumed by the model.", "verified": "2026-08-25" }, { "id": "R4-FAQ22", "question": "What is tool shadowing?", "answer": "A malicious server’s metadata alters how the model uses a different, trusted tool or server.", "verified": "2026-08-25" }, { "id": "R4-FAQ23", "question": "What is a tool rug pull?", "answer": "A server changes a previously approved tool definition later, adding hostile behavior or instructions.", "verified": "2026-08-25" }, { "id": "R4-FAQ24", "question": "Does a user approval dialog stop tool poisoning?", "answer": "Not necessarily. Approval is weak when the UI hides the full metadata, arguments, destination or data being transferred.", "verified": "2026-08-25" }, { "id": "R4-FAQ25", "question": "What is indirect prompt injection in MCP?", "answer": "Attacker-controlled resource content or tool output becomes model context and attempts to redirect the agent from the user’s intent.", "verified": "2026-08-25" }, { "id": "R4-FAQ26", "question": "Does MCP solve prompt injection?", "answer": "No. MCP carries data and capabilities; it does not reliably separate natural-language instructions from untrusted content.", "verified": "2026-08-25" }, { "id": "R4-FAQ27", "question": "Can MCP servers execute shell commands?", "answer": "A server can expose such a tool, but the protocol does not require it. Shell execution should be avoided or tightly constrained and sandboxed.", "verified": "2026-08-25" }, { "id": "R4-FAQ28", "question": "Can an MCP server access all files?", "answer": "Only if its implementation and OS permissions allow it. Hosts should constrain paths, environments and process authority.", "verified": "2026-08-25" }, { "id": "R4-FAQ29", "question": "What is an MCP supply-chain attack?", "answer": "It is compromise through a package, dependency, binary, image, publisher account, registry record or update path rather than through the protocol wire format.", "verified": "2026-08-25" }, { "id": "R4-FAQ30", "question": "Does the official MCP Registry scan server code?", "answer": "Its listing and namespace functions should not be treated as a code-security audit. Consumers must verify the package and operation separately.", "verified": "2026-08-25" }, { "id": "R4-FAQ31", "question": "Is an official vendor MCP server automatically safe?", "answer": "No. Official ownership improves provenance but does not eliminate implementation vulnerabilities or unsafe permissions.", "verified": "2026-08-25" }, { "id": "R4-FAQ32", "question": "Are open-source MCP servers safer?", "answer": "Open source permits inspection, but visibility is not the same as review, secure builds, safe dependencies or secure deployment.", "verified": "2026-08-25" }, { "id": "R4-FAQ33", "question": "What is a shadow MCP server?", "answer": "An unapproved or unmanaged server operating outside organizational inventory and policy.", "verified": "2026-08-25" }, { "id": "R4-FAQ34", "question": "How should MCP secrets be stored?", "answer": "Use managed secret stores or narrowly scoped, short-lived credentials. Do not expose the host’s full environment to every local server.", "verified": "2026-08-25" }, { "id": "R4-FAQ35", "question": "Should MCP servers use service accounts?", "answer": "Sometimes, but shared service accounts can erase user attribution and bypass user-level permission inheritance. The identity model must match the operation.", "verified": "2026-08-25" }, { "id": "R4-FAQ36", "question": "How should MCP tools enforce permissions?", "answer": "Authorize every invocation against the authenticated principal, tenant, requested object and operation; do not rely on the tool description.", "verified": "2026-08-25" }, { "id": "R4-FAQ37", "question": "What should an MCP audit log contain?", "answer": "Identity, server and tool, authorization decision, target, sanitized parameters or hashes, result status, side effects, latency, policy changes and correlation identifiers.", "verified": "2026-08-25" }, { "id": "R4-FAQ38", "question": "Should audit logs contain prompts and tool results?", "answer": "Only when necessary and with minimization, redaction, access controls and retention limits because they may contain secrets or personal data.", "verified": "2026-08-25" }, { "id": "R4-FAQ39", "question": "Is current MCP stateless?", "answer": "The 2026-07-28 protocol core is stateless at the request/session layer.", "verified": "2026-08-25" }, { "id": "R4-FAQ40", "question": "Does stateless MCP remove state-related attacks?", "answer": "No. Explicit handles, caches, Tasks and external jobs still need authorization, binding, expiry and isolation.", "verified": "2026-08-25" }, { "id": "R4-FAQ41", "question": "What is cacheScope?", "answer": "It tells clients and intermediaries whether a cacheable result is public or private. Incorrect scope or cache keys can leak data across users.", "verified": "2026-08-25" }, { "id": "R4-FAQ42", "question": "What are MCP routing headers?", "answer": "Current Streamable HTTP uses headers such as Mcp-Method and Mcp-Name to expose routing information to ordinary HTTP infrastructure.", "verified": "2026-08-25" }, { "id": "R4-FAQ43", "question": "Can routing headers be trusted instead of the request body?", "answer": "Implementations must validate header and body consistency rather than using unchecked routing headers as an authorization oracle.", "verified": "2026-08-25" }, { "id": "R4-FAQ44", "question": "What security risks do MCP Apps add?", "answer": "Server-provided UI can introduce phishing, message-origin, network, tool-call and consent risks unless sandboxed and mediated.", "verified": "2026-08-25" }, { "id": "R4-FAQ45", "question": "What security risks do MCP Tasks add?", "answer": "Long-running work can outlive tokens or role changes, and task handles or results can leak across users without binding and expiry.", "verified": "2026-08-25" }, { "id": "R4-FAQ46", "question": "How many MCP servers are vulnerable?", "answer": "No defensible universal percentage exists. Studies use different discovery sources, validation methods, time windows and definitions.", "verified": "2026-08-25" }, { "id": "R4-FAQ47", "question": "Did a study find 40.55% of remote MCP servers unauthenticated?", "answer": "Yes, one 2026 preprint reported that share among 7,973 discovered live remote servers. It does not describe local or every remote deployment.", "verified": "2026-08-25" }, { "id": "R4-FAQ48", "question": "Did every OAuth MCP server have a flaw?", "answer": "The same study found a flaw in each of 119 testable OAuth servers. That is a selected subset, not the entire OAuth population.", "verified": "2026-08-25" }, { "id": "R4-FAQ49", "question": "What is the OWASP MCP Top 10?", "answer": "It is an OWASP community project cataloging ten MCP risk categories. It was still in beta on August 25, 2026.", "verified": "2026-08-25" }, { "id": "R4-FAQ50", "question": "What is the most important MCP security rule?", "answer": "Treat every server, package, tool description, resource and tool result as untrusted until provenance, authority and permitted data flow are established.", "verified": "2026-08-25" } ] }