Model Context Protocol (MCP) Security Best Practices & Hardening

1. Threat Modeling for Agentic AI Environments

Granting Large Language Models the ability to execute tools, query relational databases, and trigger operational webhooks creates tremendous developer productivity. However, it also transforms passive text generation into active system execution, introducing new security attack vectors:

2. The Credential Isolation Hierarchy

To prevent credential leaks, follow a strict hierarchy of secret management for MCP configuration files:

1. Never Commit Configs with Inline Secrets: Ensure .cursor/mcp.json or claude_desktop_config.json files containing raw tokens are added to your global .gitignore.
2. Leverage Environment Variable Expansion: Reference host environment variables rather than plaintext secrets wherever possible.
3. Scoped Personal Access Tokens: Always generate fine-grained tokens (e.g. GitHub Fine-Grained PATs) restricted to specific repositories with read-only permissions where mutation is unnecessary.

3. Hardening Database MCP Connections (Least-Privilege SQL)

When connecting PostgreSQL, MySQL, or Supabase MCP servers to Claude or Cursor, never connect using the postgres superuser account. Instead, create a dedicated, locked-down read-only role:

-- Step 1: Create a restricted MCP database user
CREATE USER mcp_reader WITH PASSWORD 'SecureRandomPassword_982#';

-- Step 2: Grant connection and schema usage only
GRANT CONNECT ON DATABASE production_analytics TO mcp_reader;
GRANT USAGE ON SCHEMA public TO mcp_reader;

-- Step 3: Grant SELECT ONLY across existing and future tables
GRANT SELECT ON ALL TABLES IN SCHEMA public TO mcp_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO mcp_reader;

-- Step 4: Explicitly revoke destructive capabilities
REVOKE CREATE ON SCHEMA public FROM mcp_reader;
REVOKE ALL PRIVILEGES ON DATABASE production_analytics FROM mcp_reader;

4. Container Sandboxing via Docker

For maximum workstation protection, execute third-party or community MCP servers inside isolated Docker containers. This limits the server's visibility to only the explicitly mounted directories:

# Run MCP Server in a hardened, read-only Docker container
docker run -i --rm \
  --cap-drop=ALL \
  --read-only \
  --network=bridge \
  -e GITHUB_PERSONAL_ACCESS_TOKEN="ghp_..." \
  -v /path/to/project/src:/workspace:ro \
  mcp/github-server:latest

Notice the :ro flag on the volume mount, ensuring the AI assistant can analyze code without any ability to modify local files on disk.

5. Human-in-the-Loop Confirmation Workflows

For actions that modify external state—such as issuing financial refunds, deleting cloud infrastructure resources, or deploying to production—always configure your AI host client to require explicit human confirmation before tool dispatch.

In Claude Desktop and Cursor IDE, mutating tools trigger an interactive permission prompt in the chat UI. Never toggle “Always allow for this server” on high-impact administrative tools.

6. Audit Logging & Stderr Telemetry Monitoring

Under the Model Context Protocol specification, servers emit diagnostic logs over the standard error stream. Configure your monitoring pipelines to capture and aggregate stderr logs across all active agent sessions:

• Track Anomaly Spikes: Alert on sudden increases in 401 Unauthorized or 403 Forbidden responses from upstream services.
• Parameter Schema Validation: Verify that tool arguments conform strictly to expected regular expressions (e.g. verifying UUIDs or sanitized table names) before executing system subprocesses.
• Rate Limit Buffering: Implement exponential backoff when upstream services respond with HTTP 429 status codes.

7. Automated Credential Rotation Lifecycle

Implement strict 30-day credential rotation cycles for all personal access tokens and service role keys linked to developer workstations. Revoke stale tokens immediately upon offboarding team members or decommissioning experimental MCP tool integrations.