typescript-sdk

Least-privilege permissions

• Define MCP server capabilities with explicit resources and tools lists; avoid wildcard or open-ended access patterns
• Implement role-based resource filtering—authenticate clients and return only data their role permits
• Isolate sensitive operations (database writes, external API calls) behind gated tools with strict parameter validation
• Use environment variables or secure vaults for credentials; never embed secrets in server configuration or allow clients to enumerate them

Network isolation

• Run MCP servers on localhost or private networks; restrict client connections by IP/network ACL when possible
• Use TLS for all client-server communication; validate certificates and disable plaintext transport
• Implement authentication (API keys, mTLS) on server connections; reject unauthenticated clients before processing requests
• Proxy MCP servers behind a network boundary (firewall, private container network) if they access internal APIs or databases

Monitoring

• Log all client requests, resource accesses, and tool invocations with timestamps and caller identity
• Alert on repeated failed authentication, unusual resource queries, or tool calls with suspicious parameters
• Audit credential access patterns—flag any attempt to read secrets from environment or config
• Monitor outbound data flow from resources; detect large or sensitive data transfers to external LLM APIs

Red flags to watch for

• Using unofficial or forked versions of MCP packages; always install from @modelcontextprotocol/* on npm
• Passing raw user input or LLM-generated content directly into tool parameters or resource queries without sanitization
• MCP servers that echo client input back into logs, errors, or resource descriptions (enabler for prompt injection)
• Storing or caching sensitive enterprise data in long-lived context objects accessible to multiple client sessions