Security Architecture

Threats

●       Prompt injection

●       Tool injection

●       Retrieval poisoning

●       Memory poisoning

●       Privilege escalation

●       Hidden instructions in documents

●       Fake knowledge sources

MCP-Specific Threats

●       Tool rug-pull — a connected MCP server changes its tool definitions after the host has already approved them.

●       Mix-up / issuer-confusion attacks — an authorization response is accepted from the wrong issuer; the 2026-07-28 spec mitigates this by requiring clients to validate the `iss` parameter (RFC 9207).

●       Untrusted tool input — treat every tool input as coming from the model, not directly from the user; enforce strict JSON Schema with `additionalProperties: false`.

●       Skill/Server supply-chain risk — a Skill or MCP server is executable content; vet sources the same way you would a new dependency.

Controls

●       Signed sources

●       Source trust scores

●       Sandboxed tool execution

●       Least privilege credentials

●       Tool allowlists

●       Input sanitization

●       Retrieval filtering

●       Human gates

●       OAuth issuer validation and scope-bound credentials for all remote MCP servers (New)