Skip to main content
VerifiedGuidance

Model Context Protocol security best practices

The companion security document names the attacks that break agent authority in practice: the confused deputy, token passthrough, session hijacking, server side request forgery, local server compromise and over broad scopes. Its mitigations are normative. The sharpest is a flat prohibition: an MCP server must not accept any token that was not issued for it.

The verdict

Verified

The document exists. The ledger fetched it at its publisher and quotes it.

Key facts

What the sources say

Record ID
AAL-2026-0005
Kind
Guidance
Jurisdiction
Global
Last verified
Added
  • Token passthrough is an anti pattern where a server accepts a token from a client without validating it was issued to that server, and the document forbids it.
  • MCP proxy servers using a static client id must implement per client consent before forwarding a user to a third party authorization server.
  • MCP servers that implement authorization must verify all inbound requests, and must not use sessions for authentication.
  • Session identifiers must be secure and non deterministic, and should be bound to user specific information.
  • The scope minimization section warns that publishing every scope in scopes_supported hands a stolen token the whole surface.

Dimension by dimension

5 dimensions, each one stated, silent or open

Authorization, Human approval, Limits, Logging and audit, Accountability. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

AuthorizationStated
Audience validation is the control: a token that does not name this server is refused rather than forwarded.Model Context Protocol, Security Best Practices, primary source, 18 June 2025.
Human approvalStated
A proxy must show its own consent page naming the client, the third party scopes and the redirect URI before any third party authorization begins.Model Context Protocol, Security Best Practices, primary source, 18 June 2025.
LimitsStated
Least privilege is spelled out: start from a minimal scope set and elevate through targeted challenges rather than granting a full catalogue up front.Model Context Protocol, Security Best Practices, primary source, 18 June 2025.
Logging and auditStated
The document argues token passthrough destroys the audit trail, because downstream logs then show a different identity from the server that actually forwarded the call.Model Context Protocol, Security Best Practices, primary source, 18 June 2025.
AccountabilityStated
Identifying which client made which call is named as a reason to refuse opaque upstream tokens.Model Context Protocol, Security Best Practices, primary source, 18 June 2025.

What it changes

For a team deploying an agent

This is the checklist for anyone standing up an MCP server. Three findings account for most real damage: a server that forwards a token it did not mint, a proxy with no consent screen of its own, and a session id treated as proof of identity. Each has a one line test and each has a named mitigation here.

Sources

What this record was verified against

  1. Model Context Protocol, Security Best PracticesPrimary · 18 June 2025

Related

Records that sit beside this one

Cite this record

Free to reuse under CC BY 4.0, with attribution. The record ID AAL-2026-0005 is permanent and is never reused.

In a sentence
According to the GAGE Agent Authority Ledger (as of 15 September 2026), model context protocol security best practices.
APA
GAGE (Global Academy of Generative-AI Education). (2026). Model Context Protocol security best practices. Agent Authority Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0005-model-context-protocol-security-best-practices
MLA
"Model Context Protocol security best practices." Agent Authority Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0005-model-context-protocol-security-best-practices.
Chicago
GAGE (Global Academy of Generative-AI Education). "Model Context Protocol security best practices." Agent Authority Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0005-model-context-protocol-security-best-practices.
Permalink
https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0005-model-context-protocol-security-best-practices

Last updated . Every record re verified . The ledger is checked weekly, every Monday, and the same day for any NIST, IETF or MCP publication.

Back to the full ledger, or every record for Global and every guidance record.

GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.

Powered by GAGE, free EU AI Act tools from the Global Academy of Generative-AI Education
CallEmailHelp