MCP Security: Risks and Best Practices
Last updated 2026-09-14
Quick answer
MCP servers can read your files, query your databases and act on your behalf. That power is useful and also the risk. This guide covers the practical controls that matter most.
Principle of least privilege
Give each server the narrowest access that still does the job. Scope filesystem servers to specific folders, use read-only database credentials where possible, and avoid servers that request broad account access.
Prompt injection via tool output
Because tool results are fed back to the model, a malicious web page or document can try to instruct the model to take harmful actions. Treat untrusted content as untrusted: prefer read-only tools for browsing, and review any action that writes, sends or spends.
Keep secrets out of the prompt
Pass API keys through the server's env configuration, never in chat. A model should not need to see a credential to use a tool, and anything typed into a conversation should be assumed to be logged.
Remote servers and supply chain
Before adding a server, check:
- ▸Who publishes it — prefer the official vendor or a well-known maintainer
- ▸Repository activity — recent commits and a healthy issue tracker
- ▸What it can reach — network access, files, and any write operations
- ▸Install source — pin versions instead of always pulling latest
Review before you automate
Keep a human in the loop for irreversible actions (payments, deletions, sending messages). Logging which tools were called and with what arguments makes incidents far easier to investigate.
Frequently asked questions
Can an MCP server steal my data?＋
A server runs with the permissions you grant it, so a malicious or compromised server could. Only install servers you trust, scope their access, and pass secrets through env rather than chat.
What is prompt injection in MCP?＋
It is when untrusted content returned by a tool contains instructions that trick the model into misusing other tools. Limiting write-capable tools reduces the impact.
Are remote MCP servers less safe than local ones?＋
They carry different risks. Local servers can reach your machine; remote servers see the data you send them. Check the provider and what data leaves your machine.