61% of public MCP servers we scanned had a security issue

Hardening checklist for MCP server authors

The five issue classes above map to five fixes. Every one showed up as a preventable pattern in the servers that were clean.

• Authenticate the transport. If you bind a network port, require a bearer token (timing-safe compare) — a Host/Origin allowlist is not a security boundary. Default to loopback; make remote bind explicit and opt-in.
• Contain every path argument. Resolve to a real path and assert it is inside an allowlisted root. Beware the language trap: in Python, Path(base) / user_path is discarded entirely when user_path is absolute; in Node, path.join does not stop ../ escapes.
• Validate outbound URLs. Any tool that fetches a caller-supplied URL needs a scheme allowlist and a private/link-local IP block, plus DNS-rebinding protection left on — not off.
• Parameterize queries; never f-string SQL or JSON. Build SQL with bound parameters and outbound request bodies with a real serializer, never string interpolation of tool arguments.
• Scope credentials narrowly. Do not attach a connection's auth header to a caller-chosen host, do not forward the full parent environment to child processes, and keep secrets out of tool output and logs. Guards enforced with assert vanish under python -O — use real checks.