mcp-security-sandboxing

MCP Security & Sandboxing

An MCP server is a direct execution surface for an LLM that reads untrusted text. Treat it like any other public API — with extra caution because the caller is manipulable.

When to Use

• Hardening an MCP server before production
• Reviewing an MCP server for security issues
• Handling agents that process untrusted user content (emails, tickets, web pages)
• Building tools that touch the filesystem, shell, or databases

Threat Model

Principle: Destructive Tools Require Explicit Confirmation

Tools that write, delete, or spend money MUST NOT execute on arbitrary agent input. Options, strongest first:

1. User-confirmed elicitation: tool returns requires_confirmation: true and the client prompts the human
2. Dry-run by default: tool takes dry_run: boolean and defaults to true
3. Idempotency + audit: tool requires idempotency_key; every call logged with full arguments

server.tool(
  "delete_resource",
  "Delete a resource. Requires confirm=true after reviewing impact.",
  {
    id: z.string(),
    confirm: z.boolean().default(false).describe("Must be true to actually delete"),
    dry_run: z.boolean().default(true),
  },
  async ({ id, confirm, dry_run }) => {
    if (!confirm || dry_run) {
      const impact = await assessImpact(id);
      return { content: [{ type: "text", text: `Dry run — would delete: ${JSON.stringify(impact)}. Set confirm=true and dry_run=false to proceed.` }] };
    }
    await doDelete(id);
    return { content: [{ type: "text", text: `Deleted ${id}` }] };
  },
);