Is it safe to install any MCP server?

No. A local MCP server runs on your machine with the same privileges as the AI client, so a malicious or buggy one can read files and run commands. Install only servers from sources you can identify, and review what they are allowed to do.

What permissions should an AI agent have?

Only the ones its single job needs. Start read-only, add write access tool by tool, and keep payments, deletions and publishing behind a human approval step.

AI agent security: permissions, MCP and credentials

Before an AI agent with tool access goes live, limit its permissions to the minimum, require human approval for risky actions, vet every Model Context Protocol (MCP) server, use narrow credentials, log every tool call, and decide which data the agent may never touch.

What should you lock down before an AI agent goes live?

Lock down six areas: tool permissions, approvals, MCP servers, credentials, logging and data boundaries. An agent is an AI model connected to tools that act on its behalf. If someone manages to steer it with prompt injection, the damage is limited to whatever the agent was allowed to do. Each control below shrinks that limit.

Use this table as a review before launch. Every row should have a named owner and a yes.

#	Area	Question to answer	Pass condition
1	Tool permissions	Can the agent do anything its job does not need?	Each tool is allow-listed, and read-only unless writing is essential
2	Approvals	Which actions can cause loss if wrong?	A person approves sending, deleting, paying and publishing
3	MCP servers	Do we know who wrote each server and what it can reach?	Every server is vetted, pinned and documented
4	Credentials	Does the agent use its own narrow key?	One scoped, revocable credential per agent, kept out of prompts
5	Logging	Can we reconstruct what the agent read and did?	Every tool call is logged with time, inputs and outcome
6	Data boundaries	Which data must the agent never see?	Sensitive stores are excluded, and untrusted input is treated as untrusted

How do you apply least privilege to agent tools?

Give each agent only the tools and access levels its one task requires, and nothing more. OWASP’s advice for prompt injection includes least privilege, with sensitive functions kept in application code using the application’s own tokens instead of the model’s reach.

In practice:

Write down the agent’s single job in one sentence.
List the tools that job needs. Remove the rest.
Set each tool to read-only first. Add write access only where the job fails without it.
Restrict file and network access to named folders and domains.
Run separate agents for separate jobs instead of one agent with every permission.

When should a human approve an agent’s action?

A person should approve any action that is hard to undo or costs money, such as sending external email, deleting data, issuing refunds, changing access rights or publishing content. OWASP lists human approval for high-risk actions as a standard control for prompt injection. Show the approver the exact action, such as the recipient and the message, and not only a summary written by the agent. An approval screen that hides details trains people to click yes.

How do you vet an MCP server?

Vet an MCP server the way you would vet software you install on a work computer, because that is what it is. The Model Context Protocol (MCP) is an open standard for connecting AI applications to files, databases, tools and workflows. The glossary entry for MCP has the short version.

The official MCP security best practices page warns that local MCP servers run on the user’s machine and can reach files and processes there. It lists arbitrary code execution and data exfiltration among the risks, and says clients should show the exact startup command and ask for approval before connecting a new local server. It recommends sandboxing servers with minimal default privileges.

Before you connect a server:

Identify the author and where the code comes from. Prefer servers from the vendor of the service you are connecting.
Read the exact command the client will run. Refuse anything you do not understand.
Check which tools the server exposes and which scopes it requests.
Run it in a container or restricted account where you can.
Pin the version and re-review when it updates.
Remove servers you no longer use.

For servers that sign users in to other services, the same page says MCP servers must not accept tokens that were not issued for them, a pattern it calls token passthrough. Ask your developer or vendor to confirm this.

How should you handle agent credentials?

Give every agent its own narrowly scoped credential that you can revoke on its own. The MCP security page describes scope minimisation: tokens with broad scopes such as full file or database access make a stolen token far more damaging, and the page recommends starting with a small set of low-risk scopes and raising access only when needed.

Never paste keys into prompts, system messages or shared documents.
Use separate keys per agent and per environment, with spend limits where the provider offers them.
Rotate keys on a schedule and immediately after any suspected leak.

The step-by-step guide is how to store AI API credentials.

What should you log, and which data should stay out of reach?

Log every tool call with the time, the tool name, the inputs and the result, and keep those logs somewhere the agent cannot edit. The MCP page notes that unclear tokens and shared identities make auditing and incident investigation harder, which is one more reason for one credential per agent.

Then set data boundaries. Decide which stores the agent may never read, such as payroll, health records or full customer exports. Treat everything the agent reads from outside, including web pages, inbound email, uploads and reviews, as untrusted text that may contain instructions aimed at the agent. Keep that content separate from your own instructions, and never let it widen the agent’s permissions.