Your MCP server shipped in six weeks and now it has a write-capable tool, a long-lived API token, and no idea which client is calling it. In 2026 that combination is the attack surface: prompt-injected tool descriptions that rewrite themselves after approval, confused-deputy flows where your server happily replays a token upstream, and OAuth implementations that “work” because the client never validates the audience. Security teams are blocking MCP deployments outright, and most of the rejections come down to the same handful of unanswered questions — which identity, which scope, which network, which sandbox.
Written for developers who build or operate MCP servers in Python or TypeScript and already understand HTTP, containers, and the basics of OAuth. You should be comfortable reading SDK source and editing a Dockerfile. This is not an introduction to what MCP is, not a tutorial on building your first tool, and not a compliance or SOC 2 workbook — it is the hardening layer that goes on top of a server you already have running.
AI is genuinely useful here for drafting scope maps, generating adversarial test cases against your own tools, and summarizing audit logs into incident timelines. It is unreliable at OAuth 2.1 specifics — models routinely hallucinate resource indicator behavior, conflate authorization server and resource server duties, and produce PKCE code that validates nothing. Trust boundaries, token lifetimes, and anything that decides whether a human gets asked before a destructive action are human review, non-negotiable. Assume every generated security control is wrong until you have tested it failing closed.
What This Guide Covers
- A concrete threat model for MCP server security — the specific attack classes that matter, so you stop guessing what to defend
- How to choose between stdio and Streamable HTTP transports as a security decision, not a convenience one
- Getting OAuth 2.1 right for MCP: the authorization server and resource server split, and why conflating them breaks your isolation
- Stopping token passthrough and confused-deputy attacks with PKCE and resource indicators done properly
- Designing least-privilege tool scopes that survive contact with real users, in both FastMCP and the TypeScript SDK
- Detecting rug-pull tool redefinition by pinning manifests, so a server can’t silently change what it asked permission for
- Building human-in-the-loop approval gates with elicitation that users actually read instead of reflexively clicking through
- Sandboxing servers with rootless Docker, gVisor, and seccomp profiles — with the tradeoffs of each spelled out
- Locking down egress so a compromised tool can’t exfiltrate to an attacker-controlled endpoint
- Secrets architecture where credentials never enter model context, using 1Password and Vault patterns
- Gateway deployment options including Docker MCP Gateway and remote hosting on Cloudflare, and when each is worth the complexity
- Structured audit logging designed for incident reconstruction, not just debugging
- Red-team exercises you can run against your own server before someone else does
- A pre-production checklist and incident runbook, plus case studies of real failures and what they cost
Instant online access the moment checkout completes — read it in your browser on any device, no download required, no upsell, no follow-on course.
Reviews
There are no reviews yet.