Filesystem and network containment covers what an agent can reach on your machine. MCP is how it reaches everything else — your repositories, your databases, your cloud accounts, your internal services. It is the highest-value authority in the whole setup, and it is usually the least governed.
Give the agent the capability, not the credential.
None of these is a flaw in the protocol. Every one is a client choosing to treat something a server said as something a user decided.
An MCP server advertises its tools, with names, descriptions and schemas — all supplied by the server. If a client makes an advertised tool callable, the server decides its own permissions.
Tools become invocable only by exact registration in BitShout. An unapproved discovered tool is denied, and a description is never a permission.
A server can change a tool’s description or behaviour after you approved it. The approval was for what it said last week.
Registration is by exact identity, and effects are explicit security labels rather than adjectives the server chose. A tool that reports an unexpected effect is not promoted to authority.
The usual pattern is to hand the MCP server a long-lived token so it can act. Now the token’s full authority is reachable by anything that can reach the server.
Credentials are broker-owned. The broker performs the approved operation and returns the result; there is no raw token retrieval and no generic proxy.
The tool is approved. The arguments are not what you imagined — a wider path, a different repository, a `--force`.
Parameters are normalised before policy evaluation and scoped by the grant. Parameter and tool scope denial is part of the proven path.
Tool output goes straight back into the model’s context. A malicious result is an instruction channel.
Results are sanitised, and an oversized or malformed response fails closed rather than being passed through. Containment also means the instruction cannot become an operation.
The agent cannot reach production. The MCP server can. The agent asks the server.
Broker authority is resolved from the calling process’s containment session, not from the server’s own privileges. Outside an active session, capability authority is denied rather than treated as ordinary host authority.
The trusted service is the only broker entry point. Ordering is the security property here: authority is fully established before any secret is touched, so there is no window in which a credential has been retrieved for a call that then turns out not to be allowed.
All of it useful. None of it authority. It is the server describing itself.
Revalidated on every use. Stale evidence fails closed.
The Model Context Protocol is a standard way for AI applications to discover and call external tools — repositories, databases, ticketing systems, cloud accounts, internal services. It matters for security because it is where an agent stops being a text generator and starts being an actor with reach into systems that have nothing to do with your laptop.
Six recur: treating tool discovery as authorization; tool poisoning and post-approval changes; handing servers long-lived credentials; parameter smuggling within an approved tool; injection carried in tool results back into the model context; and confused-deputy escalation where the agent uses a server’s privileges to reach something it could not reach directly. All six are authority problems rather than protocol bugs.
No. MCP is a transport and a schema; it is not a permission system and does not claim to be. The insecurity comes from clients that treat a server’s self-description as a grant. The protocol tells you what a tool says it does — deciding whether this process, in this session, may call it with these arguments is the client’s job, and that is the job most clients are not doing.
Invert the custody. Instead of giving the server a reusable credential, keep the credential with a broker that validates identity, capability, resource, parameters and policy, performs the one approved operation, and returns the result. The agent and the server both receive an answer rather than a key. BitShout has no generic HTTP proxy, no credential proxy and no "reveal secret" operation for anything to find.
Local stdio MCP brokering is implemented and proven against a fixture covering discovery, invocation, schema handling, malformed responses, oversized results and credential isolation. Remote HTTP and streaming HTTP endpoint identity are represented in the domain model, but live remote transport and OAuth brokering are not part of the proven path and are not claimed yet.
It fails closed. A malformed protocol response is a denial, and an oversized result is a denial rather than a truncation. The design rule is that a server’s failure mode must never become the agent’s permission.