### Step 5: Configure client integration
(Configuration example preserved)
+
+## Security and agent safety (updated)
−## Security and agent safety (new guidance)
+MCP servers often expose sensitive operations and data. Design for defense-in-depth and assume adversarial inputs. Practical, concrete recommendations (aligned with recent industry guidance):
+- Minimize privileges: give each session and tool the least privilege required. Implement role-based checks and scope-scoped tokens; prefer separate service accounts for high-risk tools.
+- Constrain risky actions: treat network-accessing, filesystem, and destructive tools as high-risk. Require explicit session-level approval for such tools (incremental consent) and require confirmation steps for irreversible actions.
+- Validate inputs and outputs: perform strict schema validation (Zod or equivalent) server-side and sanitize outputs before returning to the client. Log validation failures and surface them as structured errors.
+- Limit sensitive data exposure: redact or truncate secrets in resources and notifications; never embed credentials in tool descriptions or resource payloads.
+- Use session consent and audit logs: record which agent/session invoked which tool, parameter values (redacted), and outputs returned. Store immutable audit events for compliance and post-hoc review.
+- Progress and timeouts: long-running or stateful operations should report progress via notifications and allow cancelation tokens; do not block JSON-RPC request threads for extended durations.
−MCP servers often expose sensitive operations and data. Design for defense-in-depth and assume adversarial inputs. Practical recommendations (aligned with recent industry guidance):
+- Prompt-injection mitigation: prefer deterministic, validated tool APIs over free-text execution. Never interpret tool descriptions or resource content as executable instructions without strict validation. Design the client-server contract so a successful prompt injection yields only limited impact (e.g., read-only view with minimal derivable secrets).
−- Minimize privileges: give each session and tool the least privilege required; favor read-only resources where possible
+References for these patterns include industry guidance on prompt injection and agent runtimes (see OpenAI links in References).
−- Constrain risky actions: treat network-accessing or destructive tools as high-risk; require explicit per-session consent or multi-step confirmation
−- Validate inputs and outputs: perform strict schema validation (Zod) and server-side checks for authorization and content
−- Limit sensitive data exposure: redact or truncate secrets in resources and notifications; never embed credentials in tool descriptions
−- Use session consent and audit logs: record which agent/session invoked which tool, inputs provided, and outputs returned for post-hoc review
−- Progress and timeouts: long-running or stateful operations should report progress via notifications rather than blocking the session
−- Prompt-injection mitigation: design the server and client so that a successful injection has limited impact — prefer deterministic, validated tool APIs over free-text execution. (See OpenAI: "Designing AI agents to resist prompt injection", Mar 11, 2026.)
Additional MCP-specific considerations (from the 2025-11-25 changelog):
−- Authorization discovery: the spec adds support for OpenID Connect Discovery 1.0 — implementors should support OIDC discovery endpoints for authorization server configuration where applicable (see MCP changelog: https://modelcontextprotocol.io/specification/2025-11-25/changelog).
+- Authorization discovery: the spec adds support for OpenID Connect Discovery 1.0 — implementors should support OIDC discovery endpoints for authorization server configuration where applicable.
- Incremental scope consent: the spec and SEPs enable incremental scope consent patterns using WWW-Authenticate headers; treat high-risk tools as requiring explicit incremental consent flows and record consent events in audit logs.
- Icons and metadata: servers MAY expose icon metadata for tools, resources, and prompts; clients can use this metadata to improve UX (spec changelog and SEP references documented in the spec).
−
−References: OpenAI posts on prompt injection and on equipping models with a computer environment describe the shift to agent runtimes and the need to constrain actions and surface controls for safety (OpenAI, Mar 11, 2026).
## Examples
