Your Insecure MCP Server Won't Survive Production
summary
Claims five concrete rules for secure MCP design including five core principles (shrink attack surface, schema-validated inputs, defensive docs, minimal responses, minimize blast radius), demonstrates migration from local stdio to HTTP with performance data where 20 out of 22 requests failed under 20 concurrent connections, walks OAuth 2.1 flows and compares Dynamic Client Registration vs Client ID Metadata Document (CIMD), shows token-exchange and scoped short-lived credentials, and links to an open-source MCP server implementation and slides.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:29MCP server failures
- 4:58Secure MCP design rules
- 8:26Local to production MCP
- 10:13OAuth flows for MCP
- 13:47Dynamic client registration
- 19:05Client ID metadata
- 22:40Enterprise MCP security
- 24:08Summary
related talks
13mCloud MCP Servers Under Fire
02h 49mMCP Servers: Best Practices, Design Choices and Their Consequences
36mSecuring MCPs for Production
26mWho Let the Agent In? Securing MCP Servers in Production
43mServers Beyond 101 Good Practices, Design Choices and Their Consequences
17mBuilding Production-Ready MCP Servers: From AI Agents to Secure Enterprise APIs.
25mAre MCP Servers Dead?
13mMCP: Server, Client & Protocol