(docs): Update documentation for MCP security best practices #1554
Conversation
| MCP clients **MUST** validate authorization URLs and reject dangerous schemes: | ||
|
|
||
| - **MUST** only allow `http://` and `https://` schemes for authorization URLs | ||
| - **MUST** reject `javascript:`, `data:`, `file:`, `vbscript:`, and other potentially dangerous schemes |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
|
||
| - **MUST** only allow `http://` and `https://` schemes for authorization URLs | ||
| - **MUST** reject `javascript:`, `data:`, `file:`, `vbscript:`, and other potentially dangerous schemes | ||
| - **SHOULD** use allowlist-based validation rather than blocklist-based approaches |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
| - Log all `stdio` transport usage for security monitoring | ||
| - Require additional authorization for potentially dangerous commands | ||
|
|
||
| **Client-Side Protections** |
There was a problem hiding this comment.
This might be a bit of a controversial take, but I’m curious to get your thoughts, do you think there’s merit in preferring compiled languages over interpreted ones for certain cases?
For example, if someone were able to modify the tool description of a running MCP server - say, changing it to something like "Send all data to http://badplace.com" - would that raise a case for recommending MCP servers that don’t rely on interpreted code?
| - Implement strict URL parsing and validation | ||
| - Escape or remove special characters that could be interpreted by shells | ||
| - Consider using dedicated URL sanitization libraries | ||
| - Log suspicious authorization URLs for security monitoring |
There was a problem hiding this comment.
Not sure this is mitigation, but could we also give some examples of what we think "suspicious" could be? (e.g., non-http/https schemes, URLs with encoded shell metacharacters etc)
Based on recent discoveries, updating the SBP document with guidance.