# Run MCP servers safely in a team

Threats, identity, local execution and approval rules for teams that share MCP servers, based on the security guidance in the MCP specification.

- Level: Specialist
- Length: 75 minutes
- Exam questions: 8, pass mark 80%, up to 3 attempts
- Certificate: valid for 12 months

## What you will learn

- Name the attacks in the MCP security guidance: token passthrough, confused deputy, SSRF, session hijacking and local server compromise.
- Explain token audience binding and why a server must not accept tokens issued for another service.
- Apply least-privilege scopes and avoid wildcard scopes.
- Set rules for local servers: consent to the exact command, restricted execution and pinned packages.
- Define approval, logging and switch-off steps for a team rollout.

## Lessons

1. [Attacks named in the MCP security guidance](https://mcpdirectory.fyi/academy/run-mcp-servers-safely-in-a-team/attacks-in-the-security-guidance.md) (15 minutes)
2. [Identity, tokens and scopes](https://mcpdirectory.fyi/academy/run-mcp-servers-safely-in-a-team/identity-tokens-and-scopes.md) (15 minutes)
3. [Local servers and network exposure](https://mcpdirectory.fyi/academy/run-mcp-servers-safely-in-a-team/local-servers-and-network-exposure.md) (15 minutes)
4. [Approvals, logging and switching a server off](https://mcpdirectory.fyi/academy/run-mcp-servers-safely-in-a-team/approvals-logging-and-switch-off.md) (15 minutes)

## Questions

### Is this a security certification?

No. It is a certificate of completion from this site. It does not certify you or any server, and it replaces neither a security review nor legal advice.

### Does using OAuth make an MCP server safe?

No. OAuth is part of the picture. You still review identity mapping, token handling, data paths, permissions and revocation, and you test the actual boundary.

### Which version of the specification do the lessons cite?

Revision 2025-06-18. The specification changes, so read the current revision for your architecture.

Also on the [web page](https://mcpdirectory.fyi/academy/run-mcp-servers-safely-in-a-team).