Threat-Model an MCP Server as a Privileged API Gateway

Short summary

A security threat-modeling guide that treats MCP servers as privileged API gateways accepting model-influenced requests. It prescribes splitting read and write credentials, scoping tokens per tenant and resource, using strict Zod schemas, binding approvals to canonical arguments, and testing prompt injection in tool output. The core principle: design as though untrusted input can reach every exposed schema.

• •Split read and write identities with short-lived scoped tokens per tenant and resource
• •Use strict schemas and server-side authorization; never let model output become raw authority
• •Bind approvals to user, tool, arguments, policy version, and expiry; test prompt injection and duplicate delivery

Generated with AI, which can make mistakes.