Local Server Security changeddocs/draft/tutorials/security/local-server-security
Nearest release: v2.1.290, published 2 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 5 Oct 2026 20:31 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 20:07 UTC.
Upstream edited
Recorded here
Lines+45added
Lines−47removed
From line
15
where the diff opens
First seen
5 Oct 2026
this site's first read of the page
Recorded edits2to this page, all time
The whole hunk
from line 15, old and new numbered
/
from line 15
1515network connections to anywhere. None of that is governed by the protocol.
1616It is governed by how you run the process.
1717
18<Note>
19 **Scope**: this guide is about servers running on a machine you (or your
20 organization's users) control — a laptop or workstation, typically launched
21 over stdio. Deploying and hardening remote or hosted servers is a different
22 topic with different controls.
23</Note>
18> [!NOTE]
19>
20> **Scope**: this guide is about servers running on a machine you (or your
21> organization's users) control — a laptop or workstation, typically launched
22> over stdio. Deploying and hardening remote or hosted servers is a different
23> topic with different controls.
2424
25<Tip>
26 **If you do one thing after reading this**: open your client's MCP
27 configuration, remove the servers you no longer use, and make sure you know
28 where each remaining one comes from and that its version is pinned. Everything
29 else in this guide builds on knowing what you are actually running.
30</Tip>
25> [!TIP]
26>
27> **If you do one thing after reading this**: open your client's MCP
28> configuration, remove the servers you no longer use, and make sure you know
29> where each remaining one comes from and that its version is pinned. Everything
30> else in this guide builds on knowing what you are actually running.
3131
3232## What a Local Server Can Touch
3333
from line 285
285285 directory to do a narrow job is overreaching. Grant a narrower directory,
286286 or pick a different server.
287287
288<Warning>
289 Configuration-level allowlists are **cooperative boundaries**: a well-behaved
290 server respects them, but nothing in the protocol stops a malicious or
291 compromised one from reading whatever the process can reach. Treat them as
292 guardrails for honest servers. Enforcement comes from the isolation layer
293 above — a sandbox or container where the allowed directory is the only
294 filesystem that exists.
295</Warning>
288> [!WARNING]
289>
290> Configuration-level allowlists are **cooperative boundaries**: a well-behaved
291> server respects them, but nothing in the protocol stops a malicious or
292> compromised one from reading whatever the process can reach. Treat them as
293> guardrails for honest servers. Enforcement comes from the isolation layer
294> above — a sandbox or container where the allowed directory is the only
295> filesystem that exists.
296296
297297**Going further**: combine allowlists with isolation, so the only filesystem
298298the server can even see is the mount you chose.
from line 316
316316 restricts them to their expected destinations and logs the attempts that
317317 fall outside it.
318318
319<Note>
320 Egress is not the only network concern. Local MCP plumbing that listens on a
321 port — bridges to remote servers, development tools, locally hosted HTTP
322 servers — is reachable by other local processes and, through your browser, by
323 websites. Binding to 127.0.0.1 is not an authentication boundary: such
324 components need real authentication and origin validation, and they need
325 prompt updates when advisories land.
326</Note>
319> [!NOTE]
320>
321> Egress is not the only network concern. Local MCP plumbing that listens on a
322> port — bridges to remote servers, development tools, locally hosted HTTP
323> servers — is reachable by other local processes and, through your browser, by
324> websites. Binding to 127.0.0.1 is not an authentication boundary: such
325> components need real authentication and origin validation, and they need
326> prompt updates when advisories land.
327327
328328**Going further**: give each server its own egress allowlist via a proxy,
329329and alert on destinations outside it — unexpected egress is often the first
from line 419
419419
420420## Next Steps
421421
422<CardGroup cols={2}>
423 <Card title="Security Best Practices" icon="shield" href="/docs/draft/tutorials/security/security_best_practices">
424 The protocol threat model: confused deputy, token passthrough, and session
425 hijacking
426 </Card>
422> **[Security Best Practices](/docs/draft/tutorials/security/security_best_practices)**
423>
424> The protocol threat model: confused deputy, token passthrough, and session
425> hijacking
427426
428 <Card title="Authorization" icon="key" href="/docs/draft/tutorials/security/authorization">
429 How OAuth-based authorization works for remote MCP servers
430 </Card>
427> **[Authorization](/docs/draft/tutorials/security/authorization)**
428>
429> How OAuth-based authorization works for remote MCP servers
431430
432 <Card title="SEP-1024" icon="file-shield" href="/seps/1024-mcp-client-security-requirements-for-local-server-">
433 Client security requirements for local server installation consent
434 </Card>
431> **[SEP-1024](/seps/1024-mcp-client-security-requirements-for-local-server-)**
432>
433> Client security requirements for local server installation consent
435434
436 <Card title="Connect to local servers" icon="plug" href="/docs/draft/develop/connect-local-servers">
437 Set up local servers in your client — the workflow this guide secures
438 </Card>
439</CardGroup>
435> **[Connect to local servers](/docs/draft/develop/connect-local-servers)**
436>
437> Set up local servers in your client — the workflow this guide secures
440438
No line in this hunk matches that.