mirrors / microsoft--mcp-for-beginners

项目文件夹

microsoft--mcp-for-beginners
文件
main
T
wehub-resource-sync c275ba2868 chore: import upstream snapshot with attribution
2026-07-13 13:31:35 +08:00

15 KiB
原始文件 永久链接 Blame 文件历史

MCP Security Best Practices 2025

This comprehensive guide outlines essential security best practices for implementing Model Context Protocol (MCP) systems based on the latest MCP Specification 2025-11-25 and current industry standards. These practices address both traditional security concerns and AI-specific threats unique to MCP deployments.

Critical Security Requirements

Mandatory Security Controls (MUST Requirements)

  1. Token Validation: MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server itself
  2. Authorization Verification: MCP servers implementing authorization MUST verify ALL inbound requests and MUST NOT use sessions for authentication
  3. User Consent: MCP proxy servers using static client IDs MUST obtain explicit user consent for each dynamically registered client
  4. Secure Session IDs: MCP servers MUST use cryptographically secure, non-deterministic session IDs generated with secure random number generators

Core Security Practices

1. Input Validation & Sanitization

  • Comprehensive Input Validation: Validate and sanitize all inputs to prevent injection attacks, confused deputy problems, and prompt injection vulnerabilities
  • Parameter Schema Enforcement: Implement strict JSON schema validation for all tool parameters and API inputs
  • Content Filtering: Use Microsoft Prompt Shields and Azure Content Safety to filter malicious content in prompts and responses
  • Output Sanitization: Validate and sanitize all model outputs before presenting to users or downstream systems

2. Authentication & Authorization Excellence

  • External Identity Providers: Delegate authentication to established identity providers (Microsoft Entra ID, OAuth 2.1 providers) rather than implementing custom authentication
  • Fine-grained Permissions: Implement granular, tool-specific permissions following the principle of least privilege
  • Token Lifecycle Management: Use short-lived access tokens with secure rotation and proper audience validation
  • Multi-Factor Authentication: Require MFA for all administrative access and sensitive operations

3. Secure Communication Protocols

  • Transport Layer Security: Use HTTPS/TLS 1.3 for all MCP communications with proper certificate validation
  • End-to-End Encryption: Implement additional encryption layers for highly sensitive data in transit and at rest
  • Certificate Management: Maintain proper certificate lifecycle management with automated renewal processes
  • Protocol Version Enforcement: Use the current MCP protocol version (2025-11-25) with proper version negotiation.

4. Advanced Rate Limiting & Resource Protection

  • Multi-layer Rate Limiting: Implement rate limiting at user, session, tool, and resource levels to prevent abuse
  • Adaptive Rate Limiting: Use machine learning-based rate limiting that adapts to usage patterns and threat indicators
  • Resource Quota Management: Set appropriate limits for computational resources, memory usage, and execution time
  • DDoS Protection: Deploy comprehensive DDoS protection and traffic analysis systems

5. Comprehensive Logging & Monitoring

  • Structured Audit Logging: Implement detailed, searchable logs for all MCP operations, tool executions, and security events
  • Real-time Security Monitoring: Deploy SIEM systems with AI-powered anomaly detection for MCP workloads
  • Privacy-compliant Logging: Log security events while respecting data privacy requirements and regulations
  • Incident Response Integration: Connect logging systems to automated incident response workflows

6. Enhanced Secure Storage Practices

  • Hardware Security Modules: Use HSM-backed key storage (Azure Key Vault, AWS CloudHSM) for critical cryptographic operations
  • Encryption Key Management: Implement proper key rotation, segregation, and access controls for encryption keys
  • Secrets Management: Store all API keys, tokens, and credentials in dedicated secret management systems
  • Data Classification: Classify data based on sensitivity levels and apply appropriate protection measures

7. Advanced Token Management

  • Token Passthrough Prevention: Explicitly prohibit token passthrough patterns that bypass security controls
  • Audience Validation: Always verify token audience claims match the intended MCP server identity
  • Claims-based Authorization: Implement fine-grained authorization based on token claims and user attributes
  • Token Binding: Bind tokens to specific sessions, users, or devices where appropriate

8. Secure Session Management

  • Cryptographic Session IDs: Generate session IDs using cryptographically secure random number generators (not predictable sequences)
  • User-specific Binding: Bind session IDs to user-specific information using secure formats like <user_id>:<session_id>
  • Session Lifecycle Controls: Implement proper session expiration, rotation, and invalidation mechanisms
  • Session Security Headers: Use appropriate HTTP security headers for session protection

9. AI-Specific Security Controls

  • Prompt Injection Defense: Deploy Microsoft Prompt Shields with spotlighting, delimiters, and datamarking techniques
  • Tool Poisoning Prevention: Validate tool metadata, monitor for dynamic changes, and verify tool integrity
  • Model Output Validation: Scan model outputs for potential data leakage, harmful content, or security policy violations
  • Context Window Protection: Implement controls to prevent context window poisoning and manipulation attacks

10. Tool Execution Security

  • Execution Sandboxing: Run tool executions in containerized, isolated environments with resource limits
  • Privilege Separation: Execute tools with minimal required privileges and separate service accounts
  • Network Isolation: Implement network segmentation for tool execution environments
  • Execution Monitoring: Monitor tool execution for anomalous behavior, resource usage, and security violations

11. Continuous Security Validation

  • Automated Security Testing: Integrate security testing into CI/CD pipelines with tools like GitHub Advanced Security
  • Vulnerability Management: Regularly scan all dependencies, including AI models and external services
  • Penetration Testing: Conduct regular security assessments specifically targeting MCP implementations
  • Security Code Reviews: Implement mandatory security reviews for all MCP-related code changes

12. Supply Chain Security for AI

  • Component Verification: Verify provenance, integrity, and security of all AI components (models, embeddings, APIs)
  • Dependency Management: Maintain current inventories of all software and AI dependencies with vulnerability tracking
  • Trusted Repositories: Use verified, trusted sources for all AI models, libraries, and tools
  • Supply Chain Monitoring: Continuously monitor for compromises in AI service providers and model repositories

Advanced Security Patterns

Zero Trust Architecture for MCP

  • Never Trust, Always Verify: Implement continuous verification for all MCP participants
  • Micro-segmentation: Isolate MCP components with granular network and identity controls
  • Conditional Access: Implement risk-based access controls that adapt to context and behavior
  • Continuous Risk Assessment: Dynamically evaluate security posture based on current threat indicators

Privacy-Preserving AI Implementation

  • Data Minimization: Only expose minimum necessary data for each MCP operation
  • Differential Privacy: Implement privacy-preserving techniques for sensitive data processing
  • Homomorphic Encryption: Use advanced encryption techniques for secure computation on encrypted data
  • Federated Learning: Implement distributed learning approaches that preserve data locality and privacy

Incident Response for AI Systems

  • AI-Specific Incident Procedures: Develop incident response procedures tailored to AI and MCP-specific threats
  • Automated Response: Implement automated containment and remediation for common AI security incidents
  • Forensic Capabilities: Maintain forensic readiness for AI system compromises and data breaches
  • Recovery Procedures: Establish procedures for recovering from AI model poisoning, prompt injection attacks, and service compromises

Implementation Resources & Standards

🏔️ Hands-On Security Training

Official MCP Documentation

Microsoft Security Solutions

Security Standards & Frameworks

Implementation Guides & Tutorials

Advanced Security Resources

Compliance & Governance

DevSecOps & Automation

Monitoring & Incident Response

🔄 Continuous Improvement

Stay Current with Evolving Standards

  • MCP Specification Updates: Monitor official MCP specification changes and security advisories
  • Threat Intelligence: Subscribe to AI security threat feeds and vulnerability databases
  • Community Engagement: Participate in MCP security community discussions and working groups
  • Regular Assessment: Conduct quarterly security posture assessments and update practices accordingly

Contributing to MCP Security

  • Security Research: Contribute to MCP security research and vulnerability disclosure programs
  • Best Practice Sharing: Share security implementations and lessons learned with the community
  • Standard Development: Participate in MCP specification development and security standard creation
  • Tool Development: Develop and share security tools and libraries for the MCP ecosystem

This document reflects MCP security best practices as of December 18, 2025, based on MCP Specification 2025-11-25. Security practices should be regularly reviewed and updated as the protocol and threat landscape evolve.

What's Next

在新工单中引用 查看 Git Blame 复制永久链接