MCP (Model Context Protocol) is a standard connecting AI applications to external tools and data. It provides a route for connecting email, drives and business systems to AI.
As connections expand, MCP security matters because the credentials and permissions used to access services move with them. In late September, a flaw was disclosed in the official MCP Python SDK that could let a malicious server cause OAuth credentials to be sent to an attacker-selected login server (The Hacker News, September 29).
KCBCA Signals recommends three practices for AI connections: validate credentials for each service, grant only necessary access, and require explicit authorization for consequential actions (p.31).
Understanding MCP through its connection structure
When an AI app sends a request to an MCP server, the server accesses an actual service such as email, a drive or a database. Tokens or OAuth credentials are used in this process.
What comes with a connection
- Credentials for logging into a service
- Read, write and delete permissions
- A route through which AI can act with those permissions
MCP security starts here. When adding a server, check what access you are allowing as well as its functions.
The official SDK flaw: where could credentials go?
A security advisory for the official MCP Python SDK was published on September 28. It described how a malicious or compromised MCP server could supply attacker-selected authorization and token servers, causing the client to send OAuth credentials there.
| Item | Details |
|---|---|
| Potentially exposed information | Client secrets, authorization codes and PKCE code_verifier (in some configurations, signed client assertions) |
| Affected versions | mcp 1.9.1–1.29.1, 2.0.0–2.1.1 |
| Fixed versions | 1.30.0, 2.2.0 |
| Conditions for exposure | An app using this SDK as an MCP client connects to an untrusted server through HTTP and OAuth |
| Action | Update to a fixed version. Specify an issuer for certain OAuth methods (ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider). Clear stored OAuth client information once and register again; rotate credentials if exposure is suspected. |
Sources: GitHub security advisory GHSA-qx49-fqc8-xw99 (September 28), The Hacker News (September 29). Severity: high (CVSS 7.5). Reported by security company Cycode.
The lesson for MCP security is not that an official SDK is inherently safe. Trusting addresses supplied by the other end of a connection can send credentials to the wrong destination. The MCP authorization specification also requires service-specific token validation and prohibits indiscriminate credential forwarding (p.31).
Keeping retrieved content from becoming instructions
Video subtitles, comments and retrieved documents are material to analyze. If AI treats sentences hidden in them as instructions, that is indirect prompt injection (OWASP, p.30).
This becomes more significant for MCP security because connected AI can call services, turning such misunderstandings into real actions. OWASP calls excessive permissions and autonomy 'excessive agency' (p.30).
Indirect prompt injection was covered in detail in the October 8 article on prompt injection.
Broad permissions amplify mistakes
One report described an AI coding agent beginning deletions to 'clean up old test state' without a user request. A path conversion error reportedly made the entire C drive the target, and the process ran for about 35 minutes without error messages, permanently deleting about 600GB without using the Recycle Bin (Boan News, October 2).
In an October 2 developer notice, Apple said granting macOS apps 'Full Disk Access' would require 'very explicit user action'. It explained that broader access carries greater risks as AI agents gain capabilities and autonomy (Boan News, October 3).
Even without an attack, broad permissions can turn one mistake into a major incident. Limits therefore need enforcement by safeguards outside the model, beyond wording that asks it to comply. Recommendations to grant only necessary access for the necessary period and maintain meaningful oversight follow the same approach (UK NCSC, p.19).
MCP security checklist: eight checks around a connection
| Check | What to do | Basis |
|---|---|---|
| Verify the server source | Connect only to servers whose creators and maintainers you have verified | SDK advisory |
| Service-specific tokens | Validate credentials separately for each service; do not reuse one token across services | p.31 |
| Separate reading and writing | Grant read-only permission when only reading is needed | p.31 |
| Confirm consequential actions | Obtain explicit human permission for deletion, sending and payment | p.31 |
| Test refusal, revocation and interruption | Test whether it stops when permissions are revoked, files are substituted or work is interrupted | p.31 |
| Limit scope and duration | Allow only necessary access for the necessary period | p.19 |
| Review the connection list | Access granted once is not permanent permission. Disconnect unused connections | p.31 |
| Keep records | Retain evidence that can explain consequential actions later | p.6 |
Frequently asked questions
Q. Is using MCP as an individual risky?
The same security principles apply to personal MCP use. Connecting email, drives or local files grants corresponding access.
Use only servers with a known source, turn off unnecessary permissions and disconnect unused connections. Backing up important files is a basic precaution.
Q. Is an application safe if it uses the official SDK?
This flaw was in the official Python SDK. Review security advisories and update to the fixed versions, 1.30.0 or 2.2.0, or later. If you use the relevant OAuth methods, also check issuer configuration and resetting client information.
Q. What should a company define first?
Start with permitted servers, permissions for each service and actions requiring explicit human approval. Test whether actions actually stop when permissions are revoked or work is interrupted, and keep records explaining consequential actions (p.6, p.31).
At a glance
- MCP connections bring credentials and permissions with them
- The official Python SDK's OAuth flaw was fixed in 1.30.0 and 2.2.0
- MCP security rests on service-specific validation, minimal access and explicit authorization for consequential actions (p.31)
- Test refusal, revocation and interruption, and retain evidence that explains actions (p.6, p.31)
For more on authorization and verification in the AI era, consult the KCBCA Signals report.
Read KCBCA Signals Vol.1 Issue 1 in full
References: KCBCA Signals Vol.1 Issue 1; Ted Kim (Shorti CEO), p.30–31; Jun Ahn (MemeCore CEO), p.19; editor's foreword, p.6. Security advisory: GitHub GHSA-qx49-fqc8-xw99 (September 28). Reporting: The Hacker News, September 29; Boan News, October 2 and October 3.
