How do you secure an MCP server with access to company systems?
Answer out loud or in your head first, then compare.
Answer
I check the caller and a token intended for this server, then the right to the specific operation and data. The model can't change its identity by adding a userId argument. Tools that write data also need limits and an audit trail.
A token confirms specific permissions for a specific audience. I don't blindly pass it on as a pass to another API. The server may need a separate upstream token. For HTTP connections, the authorisation rules depend on the protocol version, while local communication over stdio has a different trust boundary. HTTPS and a valid argument schema alone don't solve access to data.
Why it matters: Security has to work outside the model's decision.
Possible follow-ups: What about a tool that uses broader permissions than the user has?
How did it go? Be honest — “Not yet” puts the question on your review list.
Start with
- I-P01 · What is an agent harness? — Harness, MCP and coding agents
- I-P02 · What is MCP? — Harness, MCP and coding agents
- I-P04 · How does a coding agent differ from a chat that suggests code? — Harness, MCP and coding agents
Further reading
- MCP: Authorization Security Considerations(opens in a new tab)Spec; accessed 22.10.2026. Audience, token passthrough, OAuth, PKCE and the confused deputy problem.