mcp-for-beginners

Least-privilege permissions

• Scope API keys and tokens to only required resources and operations; never copy example credentials that grant broad admin or wildcard permissions into production.
• Use environment-specific credential sets (dev/staging/prod) and rotate keys regularly; avoid hardcoding secrets in curriculum examples or student projects.
• Implement role-based access control (RBAC) on MCP server handlers to restrict which tools agents can invoke based on intended use case.
• Apply principle of least privilege to file I/O and network access in tool implementations—deny all by default, explicitly allow only necessary paths and endpoints.

Network isolation

• Run MCP agents and servers in separate network segments or containers; restrict agent-to-tool communication to localhost or internal service meshes where possible.
• Validate and filter all URLs and DNS names that agents resolve before making network calls; implement allowlists for trusted external services.
• Disable or restrict file:// and other local protocol handlers unless explicitly required for the workflow; disable recursive or path-traversal capable operations by default.
• Use TLS 1.2+ and certificate pinning for inter-service MCP communication; audit external dependencies for insecure protocol configurations.

Monitoring

• Log all tool invocations (inputs, outputs, errors, and latency) with user/agent context; forward logs to a central sink and set alerts on high-volume or suspicious patterns.
• Instrument credential access and authentication failures; flag repeated failed auth attempts or unusual key rotation patterns.
• Monitor transitive dependencies in package manifests (package-lock.json, pom.xml, requirements.txt, Cargo.lock); scan regularly with tools like npm audit, Snyk, or OWASP Dependency-Check.
• Implement rate limiting and quota enforcement at the agent and tool layer; alert on unusual resource consumption (memory, CPU, file handles, network bandwidth).

Red flags to watch for

• Example code that accepts user input directly into prompts or tool arguments without validation or sanitization; always add input escaping and schema validation before deploying.
• MCP servers or tool definitions that request broad filesystem or network permissions (e.g., root directory read, : port access); refactor examples to use narrow, purpose-built scopes.
• Dependencies with known high-severity CVEs, missing maintenance, or unusual transitive chains; audit lock files and pin versions explicitly rather than accepting floating ranges.
• Hardcoded credentials, secrets in git history, or environment variables in example commits; use secret scanning (git-secrets, TruffleHog) and rotate immediately if exposed.