Ch 8 — Security, Authorization & OAuth

Protecting users, gating actions, and authenticating remote servers
IndexUnder the Hood →
High Level
-
Click play or press Space to begin...
Step- / 8
AThe Threat ModelWhy MCP needs security at every layer
1
warning
ThreatsMalicious servers,
prompt injection, data leak
mitigated by
shield
Defense LayersIsolation, consent,
least privilege
enforced by
2
hub
HostThe security
gatekeeper
3
arrow_downward User consent: the human stays in control
BUser ConsentHumans approve sensitive actions before they happen
smart_toy
LLM WantsModel decides to
call a tool
asks
person
User ApprovesHost shows what
the tool will do
then
check_circle
ExecutedOnly after
user says yes
4
arrow_downward Tool annotations: metadata for consent decisions
CTool AnnotationsHints that help the host decide what needs consent
visibility
readOnlyHintTool only reads,
no side effects
delete
destructiveHintTool may delete
or modify data
5
public
openWorldHintTool interacts with
external entities
6
arrow_downward Local vs remote: different security models
DLocal vs Remote ServersDifferent trust levels require different security
computer
Local (stdio)Runs on your machine
inherits your perms
vs
cloud
Remote (HTTP)Runs elsewhere
needs authentication
7
arrow_downward OAuth 2.1: authenticating with remote servers
EOAuth 2.1 for Remote ServersStandard authentication for HTTP-based MCP servers
login
User Logs InBrowser-based
OAuth flow
gets
token
Access TokenBearer token for
API requests
sent in
lock
Auth HeaderEvery HTTP request
includes token
8
arrow_downward Security principles: the big picture
FSecurity PrinciplesThe foundational rules of MCP security
lock
Least PrivilegeMinimum access
needed
+
shield
Defense in DepthMultiple layers
of protection
+
person
Human in LoopUser approves
sensitive actions
1
Detail