Securing MCP Servers with Scoped OAuth and Per-Agent Permission Limits

The Threat Model: MCP Tool Hijacking and Privilege Escalation

When an AI agent reads external data (such as incoming emails, customer webhooks, or PDF attachments), malicious actors can embed indirect prompt injections instructing the agent to invoke MCP tools with attacker-controlled arguments.

If your email MCP server does not enforce cryptographic allowlists and scoped execution limits, an injected prompt can order the model to exfiltrate private API keys or email confidential customer data.

Implementing Scoped OAuth Token Verification in MCP

Every MCP tool call must authenticate with short-lived tokens carrying fine-grained permission scopes (e.g. email:send:transactional vs email:admin).

import jwt from 'jsonwebtoken';

interface McpSecurityContext {
  agentId: string;
  allowedDomains: string[];
  maxDailySends: number;
  requiresHumanApproval: boolean;
}

export function verifyMcpToken(token: string): McpSecurityContext {
  const secret = process.env.MCP_JWT_SECRET!;
  try {
    const decoded = jwt.verify(token, secret) as any;
    return {
      agentId: decoded.sub,
      allowedDomains: decoded.allowed_domains || [],
      maxDailySends: decoded.daily_limit || 50,
      requiresHumanApproval: decoded.approval_mode ?? true,
    };
  } catch (err) {
    throw new Error('Invalid or expired MCP security context token');
  }
}

The 4 Golden Rules of Production MCP Security

• 1. Never expose raw SQL or arbitrary shell tools alongside email tools in the same agent context.
• 2. Enforce physical recipient allowlists at the tool execution layer, not in the prompt.
• 3. Sign every outgoing payload with an audit trail hash linking the message to the generating agent ID.
• 4. Limit token lifetimes to 15 minutes with automatic refresh rotation.