CLLMSP · Domain 4
MCP, Tool & Plugin Security
About 12% of the exam
The protocol in one card
- Host
- the application the user runs
- Client
- connection manager inside the host
- Server
- exposes tools, resources and prompts
- Tool
- callable function with a schema
- Resource
- readable data the server offers
- Prompt template
- server text the user invokes
- Roots
- directory boundary the client declares
- Sampling
- server asks the host to generate
- Transport
- local process or remote endpoint
A server writes the tool descriptions the model reads, so connecting one is closer to installing software than to calling an API
Server-side threats
- Tool poisoning
- instructions hidden in the description
- Tool shadowing
- name overlaps a trusted tool
- Rug pull
- definition changes after approval
- Stale tool cache
- revoked definition keeps running
- Injected results
- tool output carrying instructions
- Oversized results
- cost growth and wider surface
- Malicious build
- compromised release shipped for days
- Sampling abuse
- the server drives your spend
- Cross-server confusion
- one server reads another's data
Vetting a server
- Read the tool definitions yourself
- Pin a version and record the digest
- Evaluate in an isolated sandbox account
- No production data during evaluation
- Check the publisher and release history
- Keep definitions in version control
- Maintain an allowlist of named servers
Consent and approval design
- Show tool name, arguments and impact
- Prompt only for genuinely risky calls
- Session-wide consent covers unseen calls
- Avoid generic allow this server dialogs
- Re-confirm when a definition changes
- Explicit consent before server-initiated generation
Credential scoping
- One credential per server, never shared
- Least privilege through default deny
- Short-lived tokens over annual ones
- Keep production rights out of reach
- Inject secrets downstream of the server
- Per-tenant authorization behind a gateway
- Revoke every credential on compromise
Authorization pitfalls
- Prefix matching on redirect targets
- Codes redirected to an attacker path
- Missing proof key for code exchange
- Scopes broader than the tool needs
- Refresh tokens with no expiry
- Consent screens that hide the scopes
Tool result handling
- Label results as untrusted data
- Strip markup and remote references
- Block automatic loading of resources
- Cap result size before context
- Validate against the declared schema
- Never execute returned content directly
Monitoring tool calls
- Log every call with arguments
- Record the result and the principal
- Rate caps and volume anomaly alerts
- Watch for divergence from the request
- Collect telemetry outside the agent
- Successful calls matter more than failures
Change control
- Verify the digest at every startup
- Re-verify the tool list on reconnect
- Treat definition changes as code changes
- Named approver recorded in the diff
- Roll back to the approved version
Onboarding a server safely
- Request
- Review definitions
- Sandbox test
- Scope credentials
- Approve
- Pin and monitor
- Review
- Idempotency keys stop duplicate side effects
- Separate read tools from write tools
- Rename overlapping tools before enabling both
- Restrict the tool set per task
- Declare roots to bound file access
- Shell tools run sandboxed and allowlisted
Containment when a server turns
- Disconnect the server first
- Revoke every credential it held
- Replay logs for actions taken
- Check data the server could read
- Notify tenants whose scopes were reachable
Glossary
- Tool shadowing
- malicious tool impersonates a trusted one
- Rug pull
- approved component turns hostile later
- Roots
- declared directory boundary
- Sampling
- server-requested model generation
- Idempotency key
- repeat calls resolve to one
- Gateway
- single enforcement point for calls
- Confused deputy
- privilege used on the attacker's behalf
- Digest pinning
- artifact must match the approved hash
Reference strip: model, threats, consent, credentials, operations
Model
- Host, client, server, tools, resources
- The server authors what the model reads
- Roots bound the filesystem scope
- Sampling spends your inference budget
Threats
- Poisoned descriptions and shadowed names
- Rug pulls after approval
- Results that carry instructions
- Stale caches keep revoked tools alive
Consent
- Approve the call, not the session
- Show name, arguments and impact
- Re-confirm on definition change
- Prompt only where risk is real
Credentials
- One scoped credential per server
- Short-lived, revocable, never production-wide
- Inject secrets after the server
- Per-tenant authorization at the gateway
Operations
- Pin digests and verify at startup
- Definitions live in version control
- Log arguments, results and principal
- Disconnect and revoke on compromise
Quick exam traps
- Trap: A tool description is inert metadata that the model never acts on
- Trap: Approving a server once for a session is a meaningful consent gate
- Trap: Caching the tool list is only a performance decision
- Trap: Tool output is trustworthy because it came from an approved server
- Trap: A single shared upstream credential is fine behind a gateway
- Trap: Only failed tool calls are worth logging
- Trap: A sandbox evaluation with real production data reflects the true risk
cybercertprep.com · original revision sheet written from the public body of knowledge