key
Authentication, Secrets & Scope Control
MCP01, MCP02, MCP07 — tokens, privilege escalation, and auth gaps
MCP01: Token Mismanagement
Hard-coded credentials and long-lived tokens stored in model memory or protocol logs expose systems to unauthorized access. A prompt injection that extracts the agent’s context can reveal API keys, database credentials, and service tokens. Never store secrets in tool descriptions or system prompts — use a secrets manager with short-lived, scoped tokens.
MCP02 & MCP07: Privilege & Auth
MCP02 (Scope Creep): Loosely defined permissions expand over time. An MCP server initially granted read access gradually acquires write and delete capabilities without re-authorization.
MCP07 (Insufficient Auth): Weak identity verification enables cross-agent impersonation and unauthorized data access. MCP servers should require per-request authentication, not just connection-time auth.
# BAD: secrets in tool config
{
"name": "database_query",
"config": {
"db_password": "hunter2",
"api_key": "sk-abc123..."
}
}
# Prompt injection → extract context → keys
# GOOD: scoped, short-lived tokens
{
"name": "database_query",
"auth": {
"method": "oauth2",
"scope": "read:reports",
"ttl": "300s"
}
}
Principle: Every MCP tool invocation should carry scoped, short-lived credentials. The agent should never see raw secrets. Rotate tokens frequently. Log every tool call with the credential used.