# Attacks named in the MCP security guidance

Lesson 1 of [Run MCP servers safely in a team](https://mcpdirectory.fyi/academy/run-mcp-servers-safely-in-a-team.md), 15 minutes.

The MCP specification publishes security best practices that name specific attacks. Know them by name so you can ask whether a server or client defends against them.

## Token passthrough

An MCP server accepts a token from a client without checking that it was issued to that server, then passes it to a downstream API. The specification forbids it: MCP servers must not accept any tokens that were not explicitly issued for the MCP server. Passthrough weakens controls such as rate limiting that depend on the token audience, and it blurs the audit trail.

## Confused deputy

This applies to an MCP proxy server that uses one static client ID with a third-party authorization server and lets clients register dynamically. If the third-party server has already set a consent cookie, an attacker's crafted link can skip the consent screen and send an authorization code to the attacker. The specification requires such a proxy to obtain consent for each client before it forwards to the third party.

## Server-side request forgery (SSRF)

A malicious server can supply URLs that point at internal addresses during OAuth discovery, such as a cloud metadata address, a private network address or localhost. The specification recommends that clients require HTTPS, block private and reserved address ranges, validate redirects and consider an egress proxy.

## Session hijacking

A stolen or guessed session ID can be used to inject events or to impersonate a client. The specification says servers that implement authorization must verify all inbound requests, must not use sessions for authentication, and must use secure, non-deterministic session IDs.

## Local server compromise

A local server runs on the user's machine with the client's privileges, so a malicious startup command or package can run arbitrary code. Lesson 3 covers the controls.

## Sources

- MCP specification, Security best practices, revision 2025-06-18

Also on the [web page](https://mcpdirectory.fyi/academy/run-mcp-servers-safely-in-a-team/attacks-in-the-security-guidance).