---
topic: mcp-security
last_updated: 2026-07-09T14:04:40.520Z
patterns:
  - id: P-MCP-001
    summary: Treat the entire MCP/tool surface — schemas, parameter names, inputs AND responses — as an untrusted prompt-injection channel; baseline: audience-bound tokens, hash-pinned tool definitions, URL allowlists, sandboxing, human-gated writes, full invocation logging
    promoted_at: 2026-07-09T14:04:40.520Z
    source_experiments: [spec-factory]
---

# Mcp Security (AI-derived)

> Auto-maintained by `pan-tools learn promote`. Each pattern was extracted from one or more experiment runs (see source_experiments). Patterns are **advisory** — orchestrators should weight them against current context.

## P-MCP-001 — Treat the entire MCP/tool surface — schemas, parameter names, inputs AND responses — as an untrusted prompt-injection channel; baseline: audience-bound tokens, hash-pinned tool definitions, URL allowlists, sandboxing, human-gated writes, full invocation logging

**Evidence:** A factory security standard, citing injection studies (MCPTox: ~72.8% attack success on weaker models via poisoned tool metadata), treated every element of the tool surface as attacker-controllable: tool descriptions and schemas can carry injected instructions, and tool RESPONSES are as dangerous as inputs. Its baseline: OAuth 2.1 resource-server auth with RFC 8707 audience-bound tokens, tool definitions hash-pinned and re-verified before execution, URL allowlisting against SSRF, sandboxed execution, human approval for writes, and every invocation logged.

**Rule:** Never trust any part of a tool integration surface: schemas, descriptions, parameter names, and especially tool responses are all injection vectors. Minimum bar: audience-bound tokens (no token reuse across services), pin tool definitions by hash and re-verify before execution, allowlist outbound URLs, sandbox execution, require human approval for write-capable tools, and log every invocation for audit.

**Applies in:** MCP server integrations, tool-using agents, agent gateways, plugin ecosystems.