Giving an AI assistant access to your local filesystem, databases, and Docker daemon via the Model Context Protocol (MCP) unlocks tremendous productivity. But running untrusted or misconfigured MCP servers introduces critical security risks.
Here are the four essential security hardening patterns every engineering team should implement:
1. Defend Against Tool Description Poisoning
When an MCP client queries tools/list, it consumes natural language descriptions of every available tool. A compromised third-party package can inject prompt overrides directly into the tool description string (e.g. instructing the model to exfiltrate context or silently bypass confirmation dialogs).
Rule: Only install verified servers from trusted registries like MCP Bridge Directory.
2. Isolate Environment Variables
Never commit .cursorrules or mcp.json containing plaintext API secrets into git repositories.
Rule: Utilize environment variable substitution ("$DATABASE_URL") and load secrets from local .env.local files excluded via .gitignore.
3. Sandbox Host Filesystem Access
Never grant MCP servers root-level read/write access to ~ or /.
Rule: Mount directories with read-only :ro flags and restrict tool scopes to specific workspace subfolders.
4. Protect the Docker Socket
Mounting /var/run/docker.sock gives the agent root execution rights over the entire host OS.
Rule: Use a socket proxy with POST=0 or rootless Docker containers.
Read our complete hardening checklist and configuration recipes at MCP Bridge Security Guide.
Top comments (0)