Agent Security 2026: MCP Server Security — Transport, Authentication và Production Hardening

MCP servers là API endpoints mới. Và như API endpoints, chúng cần transport security, authentication, authorization, input validation, rate limiting và monitoring.

Khác biệt? MCP servers được consume bởi AI agents — không phải browsers hay mobile apps. Agents gọi tools programmatically, pass parameters generated bởi LLM, và process structured responses. Security model cần tính đến non-deterministic inputs, prompt injection qua parameters, và fact rằng compromised agent có thể gọi bất kỳ tool nào trên MCP server.

MCP Transport Security#

Transport	Default Security	Best For	Risk
stdio	Local process isolation	Local dev, CLI agents	Low
SSE	None (HTTP)	Remote MCP servers	Medium
WebSocket	None (WS)	Real-time streaming	Medium

stdio: Safer by Default#

1
{
2
  "mcpServers": {
3
    "local-db": {
4
      "command": "node", "args": ["./db-server.js"],
5
      "env": { "DATABASE_URL": "postgres://..." }
6
    }
7
  }
8
}

Không network port → không remote attacks. Process-level isolation. Credentials trong env, không trong command line.

SSE: Remote MCP Challenge#

1
@app.middleware("http")
2
async def auth_middleware(request, call_next):
3
    api_key = request.headers.get("X-API-Key")
4
    if not api_key or not validate_api_key(api_key):
5
        return JSONResponse(status_code=401)
6

7
    client_ip = request.client.host
8
    if await rate_limiter.is_rate_limited(client_ip):
9
        return JSONResponse(status_code=429)
10

11
    return await call_next(request)

Yêu cầu: TLS (HTTPS), API key/OAuth, rate limiting, logging, CORS.

Authentication Patterns#

API Key (Simple)#

1
VALID_API_KEYS = set(os.getenv("MCP_API_KEYS", "").split(","))

OAuth 2.0 (Enterprise)#

1
oauth.register(name="mcp-provider", client_id=..., scope="mcp:read mcp:tools:execute")

Short-Lived Session Tokens (Recommended)#

1
def create_session_token(agent_id, permissions, ttl=timedelta(hours=1)):
2
    payload = {
3
        "agent_id": agent_id, "permissions": permissions,
4
        "iat": datetime.utcnow(), "exp": datetime.utcnow() + ttl,
5
        "jti": uuid4().hex,  # For revocation
6
    }
7
    return jwt.encode(payload, SECRET, algorithm="HS256")

Input Validation: Last Line of Defense#

Pydantic Validation với Security Rules#

1
class QueryDatabaseParams(BaseModel):
2
    sql: str
3

4
    @validator("sql")
5
    def validate_sql(cls, v):
6
        if not v.strip().upper().startswith("SELECT"):
7
            raise ValueError("Only SELECT allowed")
8
        forbidden = ["pg_sleep", "DROP", "ALTER", "TRUNCATE"]
9
        for pattern in forbidden:
10
            if pattern.lower() in v.lower():
11
                raise ValueError(f"Forbidden: {pattern}")
12
        return v

Preventing Parameter Injection#

Parameters từ LLM có thể chứa injection. Validate parameters như untrusted input:

1
class ToolParameterSanitizer:
2
    def sanitize_body(self, body):
3
        body = re.sub(r'<(script|iframe)[^>]*>.*?</\1>', '[blocked]', body, flags=re.DOTALL)
4
        body = re.sub(r'javascript:', '', body, flags=re.IGNORECASE)
5
        return body[:10000]
6

7
    def sanitize_filename(self, filename):
8
        return os.path.basename(filename)  # Chống path traversal

Rate Limiting & Cost Protection#

1
class MCPRateLimiter:
2
    async def check_rate_limit(self, agent_id, tool_name, api_key):
3
        checks = [
4
            self.redis.get(f"ratelimit:agent:{agent_id}") < 60,    # 60/min
5
            self.redis.get(f"ratelimit:tool:{agent_id}:{tool_name}") < 10,  # 10/min
6
            self.redis.get("ratelimit:global") < 1000,              # 1000/min
7
        ]
8
        return all(checks)

Cost Attack Prevention#

1
BUDGET_LIMITS = {
2
    "per_request": 1.00,    # Max $1 mỗi request
3
    "per_hour": 10.00,      # Max $10/h mỗi agent
4
    "per_day": 50.00,       # Max $50/day mỗi agent
5
}

Docker Deployment Security#

1
services:
2
  mcp-server:
3
    ports:
4
      - "127.0.0.1:3000:3000"  # Localhost only
5
    user: "1000:1000"           # Non-root
6
    read_only: true             # Read-only filesystem
7
    deploy:
8
      resources:
9
        limits:
10
          cpus: '0.5'
11
          memory: 256M

Production Checklist#

Tiếp Theo#

Bài	Chủ đề
1	Prompt Injection & Defense
2	Tool Access Control
3	MCP Server Security (bài này)
4	Agent Auditing & Compliance
5	Production Security Patterns

Series: Agent Security 2026 — Production Patterns. Bài 3: MCP Server Security.