Security Best Practices changeddocs/2024-11-05/tutorials/security/security_best_practices
Upstream edited this page at 28 Jul 2026 15:42 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 20:37 UTC.
Upstream edited
Recorded here
Lines+3added
Lines−3removed
From line
8
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits3to this page, all time
The whole hunk
from line 8, old and new numbered
/
from line 8
88
99This document provides security considerations for the Model Context
1010Protocol (MCP), complementing the
11[MCP Authorization](/specification/2025-03-26/basic/authorization)
11[MCP Authorization](/specification/2025-03-26/basic/authorization.md)
1212specification. This document identifies security risks, attack vectors,
1313and best practices specific to MCP implementations.
1414
from line 148
148148 consent screen
1491496. The MCP authorization code is redirected to the attacker's server
150150 (specified in the malicious `redirect_uri` parameter during
151 [dynamic client registration](/specification/2025-03-26/basic/authorization#dynamic-client-registration))
151 [dynamic client registration](/specification/2025-03-26/basic/authorization.md#dynamic-client-registration))
1521527. The attacker exchanges the stolen authorization code for access
153153 tokens for the MCP server without the user's explicit approval
1541548. The attacker now has access to the third-party API as the compromised
from line 284
284284#### Risks
285285
286286Token passthrough is explicitly forbidden in the
287[authorization specification](/specification/2025-03-26/basic/authorization)
287[authorization specification](/specification/2025-03-26/basic/authorization.md)
288288as it introduces a number of security risks, that include:
289289
290290* **Security Control Circumvention**
No line in this hunk matches that.