What Are the Security Considerations in MCP?

📘 What a protocol decides, and what it cannot

A protocol decides how messages are exchanged. It does not decide who may send them, what an operation may reach, or what should happen to what comes back. Every question that makes an MCP deployment safe or unsafe lives in that gap, and none of it is answered by conforming to the specification.

Four questions do most of the work. What does this server expose, and is any of it wider than the task required? Whose credentials does it hold, and what can those credentials reach if an operation is called with arguments nobody anticipated? Which operations change something outside the calling session, and are those the ones a person is asked about? And how far away can this server be reached from — a local subprocess and a networked service have very different answers.

The fifth question is the one specific to this arrangement and the least obvious. Content returned by a server is data, and it arrives in the same channel as everything else a host is assembling. Text that comes back from an operation and reads like an instruction is still the output of an operation. Whether that distinction survives the trip into a conversation is a property of the host application, and it is the exposure this pattern introduces that a plain function call does not.

A sixth question appears only once several servers are connected at the same time, and it is invisible from inside any one of them. Each server sees its own requests and nothing more; the host sees all of them, and material read through one connection is available as an argument to an operation on another. Two surfaces that are each defensible alone — one that reads private material, one that can send something outward — compose into a path neither was reviewed for. That composition belongs to the host’s configuration rather than to any server in it, which is why it has no owner by default and why it changes every time one more connection is added.

🧩 What a review can settle, and what it cannot

A review establishes what a surface published on the day it was read, what credentials the process holds, and which of its operations reach past the calling session. Those questions have answers, and getting them is worth the afternoon it costs.

What it cannot settle is behaviour under arguments nobody supplied, or the surface in use next week: a server may announce that its list has changed, and what runs afterwards is whatever the artefact resolves to at that moment. A review is a statement with a date on it. The operational question underneath — how would anyone notice if this surface changed — is a different question, and it is usually the one nobody has been asked to answer.

📐 The question underneath predates the protocol

Underneath all of it is a question that predates the protocol: a server is a program somebody chose to run, with some access. The review that matters is the review any program given credentials and a network path deserves, and running it as an MCP server does not change what it can reach.

⚙️ How the Registry classifies reviewing what a server exposes

Reviewing the operations a surface exposes and recording which of them modify data outside the calling session is examination of an existing system, which the data processing class covers. On the order form's task class field, select Data processing, which covers data handling, transformation, analysis, and computation. That class has its own page at /tasks/analysis.

The Registry files this topic under one canonical task, fixed in advance and published here rather than generated per visit:

Review the operations an MCP server exposes and record which of them modify data outside the calling session.

That string, hashed once, is 3a8a96ad3ed956df… — the first sixteen of sixty-four hex characters. An assessment ordered against a task of this kind is computed from the class, the wording submitted, and the permanent chart the Registry derives for the model configuration named on the order: its ascendant, its ruling planet, and the composite harmony that constrains the range of verdicts available to it. The whole derivation is published at /method.

The risk in a review like this is the operation that looked read-only from its name: a report generator that writes a file, a search that logs its query somewhere else. 4 risk factors are tracked for data processing tasks generally; an assessment reports 3 of them, selected by the submitted task's own seed rather than chosen. Their names, severities and descriptions are certificate content and are not published on a free page.

Get Assessment

📏 What this page does not claim

The Registry makes no representation that an assessment predicts the outcome of any task, and no assessment is validated against real-world results.

This page defines a term and states a classification. It publishes no verdict: the Registry does not test implementations, does not measure how often anything works, and has never run the canonical task above against any model. What an acceptable exposure looks like for a given deployment, and who signs it off, are decisions the canonical brief does not attempt to make.

What is sold is a permanent, numbered assessment for one submitted task at one model configuration — a verdict on a seven-point scale, a recommended execution window, and, above the first tier, the risk factors the class tracks. EUR 1.90 Standard, EUR 4.90 Extended, and EUR 14.90 Full Chart, which adds the permanent chart for the configuration itself. Assessments from EUR 1.90; machine-readable at /pricing.json.

🔗 Related surfaces

← All MCP topics · The AFR-1 method · Data processing task class

Related topics: Authentication · Tools · Inspecting a server

❓ Questions about security

What security guarantees does MCP provide?

The specification governs how messages are exchanged. It does not decide which callers a server answers, what an operation may reach, or how a host treats the content it receives. Those decisions remain with the operator.

Why does the content a server returns matter?

Because it arrives in the same channel as everything else the host is assembling. Text returned by an operation is data, and whether it stays data once it reaches a conversation is a property of the host application.

Is running an MCP server different from running any other program?

In access terms, no. It runs with the privileges it was given and reaches what those privileges reach. The protocol adds a uniform way to call it, not a boundary around it.

Does connecting more servers to one host multiply the exposure?

It changes it in a way no single server can see. Each server answers only its own requests while the host holds all of them, so material read through one connection can be passed as an argument to an operation on another. That path is a property of the configuration, not of any server in it.