MCP Server Security Best Practices: Protecting Your Data

MCP Server Security Best Practices

Because MCP servers act as bridges between intelligent, unpredictable AI agents and your sensitive data sources, security must be your primary concern. A rogue agent with a poorly configured MCP server can accidentally drop production databases, leak confidential API keys, or expose sensitive local files.

Prerequisites

• ▸Familiarity with JSON configuration files.
• ▸Basic understanding of environment variables and your operating system's file permissions.

Principle of Least Privilege

Never give your AI agent "God Mode." Always grant the minimum permissions necessary for the specific task.

Database Servers

Do not connect the agent using a root or admin account. Create a read-only user specifically for the agent:

-- MySQL Example: Create read-only users for analysis tasks
CREATE USER 'mcp_readonly'@'localhost' IDENTIFIED BY 'strong_password';
GRANT SELECT ON analytics.* TO 'mcp_readonly'@'localhost';

API Tokens

• ▸Use fine-grained tokens (GitHub, Slack, Notion) instead of legacy classic tokens.
• ▸Set expiration dates on all tokens used by MCP servers.
• ▸Request only the necessary OAuth scopes (e.g., issues:read instead of repo:write).

File System Security

• ▸Limit the Filesystem MCP server access to specific, isolated directories only.
• ▸Never grant access to root (/), user home directories (~), or .ssh folders.
• ▸Use read-only access flags if the agent only needs to analyze code, not write it.

Credential Management

Never hardcode credentials in configuration files that are committed to version control.

Use Environment Variables

Your MCP client configuration should inject credentials via environment variables:

{
  "mcpServers": {
    "database": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-postgres"],
      "env": {
        "DATABASE_URL": "postgresql://mcp_readonly:${DB_PASSWORD}@/db"
      }
    }
  }
}

Network Security & Sandboxing

1. ▸Local-Only Bindings: When possible, ensure your MCP servers and target databases bind only to 127.0.0.1 (localhost) so they cannot be accessed over the external network.
2. ▸Container Isolation: Run MCP servers in Docker containers without --privileged mode to heavily restrict OS-level access.
3. ▸Firewall Rules: Restrict outbound connections from the MCP servers. If the server only needs to talk to a local database, block its internet access.

Data Classification Strategy

Before connecting a data source to an MCP client, classify the data and apply the appropriate security posture:

Troubleshooting & Incident Response

Have a plan for security incidents involving your AI agents:

1. ▸Monitor Logs: Keep strict logs of the JSON-RPC traffic. If you see the agent hallucinating calls like execute_sql("DROP TABLE users"), immediately investigate.
2. ▸Revoke Keys: If you suspect an agent leaked data to a public LLM provider, instantly revoke the API tokens used in the env block.
3. ▸Audit: Review the agent's chat history. LLMs leave a perfect audit trail of their "thought process" and the exact tools they invoked.