MCP Security
What the model reads can carry instructions: why risk belongs to the whole session (the lethal trifecta), how tool poisoning and rug pulls work and what pinning does, why filters fail and the backend must bound the tool, and why every installed server is supply chain.
Last updated
After this section you can
- Classify the tools of a connected session against the three legs of the lethal trifecta.
- Explain why a string filter does not bound a tool, and name the backend control that does.
- Decide what to pin, re-review and refuse for every MCP server you install.
MCP Security
Where untrusted text reaches the model, why the risk sits in the whole session, and what to bound, pin and vet.
An MCP server lends a steerable model the power to act. Security is deciding, on every request, whose power that is, how far it reaches, and what happens when the model reads text that tries to steer it.
Numbers follow the call out and back. Grey 2 and 3 are taught in MCP Authorization; teal 1, 4 and 5 are this page. The figure pans on a phone.