Model Context Protocol
What does connecting an MCP server authorize?
Reference notes by Min · Reviewed October 11, 2026
Definition
Model Context Protocol is a protocol for connecting AI applications with external capabilities and context, including tools, resources and prompts.
MCP connects AI applications to external capabilities through defined participants and interfaces. Governance still has to decide which server is trusted, what capabilities may be exposed and what authority applies to each use. Protocol interoperability alone does not establish those decisions.
What it covers
- Participants
- Hosts, clients and servers.
- Primitives
- Tools, resources and prompts with different roles.
- Security
- Transport, authorization and trust-boundary requirements.
Review server ownership, transport, authentication, tool definitions and data paths. Changes to an exposed capability can change a workflow’s scope even when the model and visible chat interface remain the same.
In practice
Practical design patterns by Min.
- Review each server’s ownership and exposed capabilities.
- Validate tokens for the intended recipient.
- Treat tool annotations and returned content as untrusted claims.
Maintain an approved-server catalogue linked to deployments and review tool changes before exposing them broadly. Treat descriptions and returned material as content whose trust depends on its source.
Apply service-side authorization and validate token handling for the intended resource. Record tool calls and results using the same task identifiers as the rest of the workflow.
Working example
Adding a calendar server
An agent is connected to calendar tools.
- Review the server and available operations.
- Grant only the required calendar scope.
- Require appropriate approval before sending invitations.
Why the controls matter
Connecting a document server can enable retrieval for one project. Enabling write or external-sharing operations later requires a separate scope decision, even through the same connection.
Common pitfalls
- Assuming protocol compatibility means a server is trustworthy.
- Passing an unrelated access token through to another service.
A server’s availability in a client does not make every returned instruction authoritative. Keep application permission decisions independent of retrieved text.
Questions for operational review
Use these questions to decide what evidence your team needs. They are editorial prompts, not a compliance checklist.
- Who operates the server?
- Which capabilities are exposed?
- Where is task authority enforced?
Articles linking here
References
Primary documents reviewed for this entry. Examples and implementation patterns are editorial synthesis.
- MCP: Introduction ↗Accessed October 11, 2026
- MCP: Security best practices ↗Accessed October 11, 2026