MCP security for production integration: identity, tools, approvals, and evidence

Decision summary

Use MCP where a standardized connection materially improves integration and governance, but evaluate the server and each capability like any other privileged dependency. The protocol connection should not collapse identity, authorization, validation, or ownership into a model decision.

Begin read-only or proposal-only. Grant a write capability only after the team has a representative task suite, a narrow tool contract, a scoped identity, an independent approval rule where consequence requires it, traceable execution, and a tested recovery path.

SOURCES: [1] Model Context Protocol · [3] OpenAI · [6] OWASP GenAI Security Project · [7] OWASP

Model the integration boundary

Inventory the MCP client, every server, operator, hosting boundary, capability, upstream dependency, credential, reachable resource, and data category. Distinguish an internally operated server from a third-party server and a local developer tool from a production service. The same friendly tool name can conceal very different authority.

Create a data-flow and execution diagram showing what leaves the organization, what enters model context, where untrusted content can become a proposed action, and where a side effect occurs. Version server configuration and tool definitions so an expanded capability surface cannot arrive as an invisible operational change.

• Server owner, code and deployment provenance, and update path
• Transport and network boundary
• Authentication and delegated identity
• Exposed capabilities and reachable resources
• Input, output, context, and log data classification
• Write effects, approvals, idempotency, and recovery

SOURCES: [1] Model Context Protocol · [6] OWASP GenAI Security Project · [8] National Institute of Standards and Technology

Reference production architecture

Place a policy and execution layer between model intent and the server capability. The model chooses from an allowlisted catalog and produces structured arguments. Deterministic code binds the authenticated user and job, validates the schema and business preconditions, authorizes the requested resource and action, obtains approval, and invokes the capability using a scoped identity.

Normalize the result before it returns to model context. Enforce size, type, content, and sensitivity limits; label the result as untrusted; and separate displayable evidence from executable instruction. Record the request, policy decision, approval, side effect, and final state using correlation identifiers.

• Authenticated request and job context
• Allowlisted server and capability registry
• Structured arguments and deterministic validation
• Policy decision and resource-level authorization
• Human approval for material actions
• Scoped execution identity and idempotent side effect
• Sanitized, labeled result and correlated trace

SOURCES: [3] OpenAI · [4] OpenAI Agents SDK · [7] OWASP

Security implications: identity, permissions, and approval

Do not grant a server a broad shared credential merely because several tools need access. Separate read and write authority, scope access to the minimum objects and operations, and use short-lived or delegated credentials where the environment supports them. Server authentication establishes a caller; it does not replace authorization for the specific resource and action.

Approval should be independent of the model. Show the approver the proposed action, target, material arguments, evidence, and expected side effect. Bind the approval to that exact request and expire it. The model must not be able to rewrite the action after approval or interpret an approval of one item as a standing permission.

SOURCES: [1] Model Context Protocol · [7] OWASP · [6] OWASP GenAI Security Project

MCP-specific authorization and transport hazards

The MCP project's July 28, 2026 security guidance forbids token passthrough: a server must not accept a client token without verifying that it was issued for that server and then forward it unchanged to a downstream API. Validate issuer, audience, expiry, client, and scopes; exchange or mint a downstream credential for the intended resource; and preserve the initiating principal in the audit record. Otherwise the integration can bypass resource controls, erase accountability, or become a confused deputy.

MCP discovery and authorization also create network and state risks. Validate every authorization and metadata URL, restrict schemes and ports, block private and link-local ranges, validate every redirect hop, and enforce egress policy to reduce SSRF. Treat workflow or cart handles as object references rather than authentication: generate them unpredictably, expire them, bind them server-side to the verified principal, and reject cross-principal reuse.

The July 28 material is a release-candidate specification update, so teams should pin the protocol version they implement and recheck the final specification before production. A current standard does not remove the need to test each client's redirect handling, server authorization flow, local-process isolation, and scope behavior.

• Per-client consent before a proxy starts a third-party authorization flow
• Exact redirect-URI validation, CSRF protection, and clickjacking protection
• No token passthrough; validate audience and use resource-specific credentials
• URL and redirect validation plus egress controls for OAuth discovery and metadata
• State handles bound to the authenticated principal, never accepted as identity
• Minimum scopes requested for the current operation rather than future convenience

SOURCES: [1] Model Context Protocol · [2] Model Context Protocol

Prompt injection, poisoned context, and unsafe results

Indirect prompt injection can enter through documents, web pages, issue bodies, messages, database fields, or tool results. OpenAI describes it as analogous to social engineering: untrusted content attempts to redirect an agent that has useful powers. The durable defense is to reduce those powers and mediate them, not rely on one instruction telling the model to ignore attacks.

Treat descriptions and metadata from an untrusted server as supply-chain input. Do not automatically expose newly discovered capabilities to production agents. Validate output schemas and lengths, prevent returned content from becoming executable code or a new credential, and restrict what sensitive results are placed back into context or traces.

SOURCES: [5] OpenAI · [6] OWASP GenAI Security Project · [8] National Institute of Standards and Technology

Observability and operational control

Trace the top-level agent request through the policy decision and tool execution. OpenTelemetry's GenAI conventions model an agent invocation with child model and tool spans, while OpenAI's tracing guidance includes tool calls, handoffs, and guardrails. The useful record identifies the server and capability, caller, policy result, duration, status, retry, approval, and resulting state.

Avoid copying complete sensitive arguments and results into general-purpose telemetry. Capture structured metadata and secure evidence references where possible. Define alerts for denied-action spikes, unexpected capabilities, repeated failures, latency, loops, unusual resources, and spend. Operators need a fast way to revoke a server or capability without disabling unrelated agent work.

SOURCES: [9] OpenTelemetry · [10] OpenAI Agents SDK

Failure modes and limits

Material failure modes include an over-privileged server, a capability whose behavior changes without review, a malicious or compromised dependency, ambiguous tool names, prompt injection in tool output, replayed writes, partial completion, stale reads followed by writes, leaked arguments in traces, and cascading failure across multiple servers.

A connection standard cannot establish that a server is trustworthy, that its data is accurate, or that a requested action is authorized. Security review must cover the actual implementation, deployment, operators, credentials, dependencies, data handling, and recovery behavior. Some high-impact use cases should remain read-only or require permanent human execution.

SOURCES: [6] OWASP GenAI Security Project · [7] OWASP · [8] National Institute of Standards and Technology

Production integration checklist

Before moving an MCP-backed capability beyond a draft or test environment, verify the following.

• Every server and capability has an owner, provenance, version, trust level, and approved use.
• Capabilities are allowlisted; discovery does not automatically grant production access.
• Arguments are typed and validated against authenticated user, job, resource, and current state.
• Read and write credentials are separated and least-privileged.
• Tokens are audience-validated and never passed through unchanged to a downstream API.
• Authorization and metadata URLs, redirects, DNS results, and egress paths are constrained against SSRF.
• State handles are unguessable, expiring, and bound server-side to the verified principal.
• High-impact actions have request-bound, expiring, independent approval.
• Results are treated as untrusted, size-limited, schema-checked, and sensitivity-filtered.
• Writes are idempotent or have a tested compensating action.
• Turns, time, retries, concurrency, and spend have external limits.
• Traces correlate intent, policy, approval, execution, and final state without indiscriminate sensitive content.
• Tests cover injection, revocation, timeout, duplication, malformed output, partial failure, and server compromise.
• Operators can disable one server or capability, investigate, recover, and replay safely.

SOURCES: [1] Model Context Protocol · [6] OWASP GenAI Security Project · [7] OWASP · [5] OpenAI · [9] OpenTelemetry

How Nautilus can help

Nautilus can inventory MCP and tool integrations, design the capability and identity boundary, implement policy, approval, validation, and traces, and test the system against representative and adversarial cases. The resulting controls stay attached to the client's actual servers, data, and operating responsibilities rather than a generic protocol-security claim.