Verified65% confidenceOpinionExact time
The caller of an MCP server is a model that may be misled, injected or simply make mistakes, so the security design must achieve "even if it errs, the fragmenting consequences are small and visible."
3
Sources
65%
Confidence
Long-term
Relevance
10/18/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe confused deputy problem is one of the MCP security risks: an MCP Server holding broad credentials performs operations on behalf of a user who should not have that permission.79% similarVerifiedMCP defines a standard response mechanism for errors occurring during tool calls.77% similarVerifiedCommon anti-patterns for MCP servers include excessive authorization, lack of request source validation, hardcoding sensitive credentials on the server side, and insufficient filtering of instructions passed in by agents.77% similarVerifiedMCP server spoofing attacks exploit the assumption in the protocol design that servers are trusted by default, rather than exploiting vulnerabilities in the traditional sense.76% similarUnverifiedThe MCP specification requires that tool annotations be treated as untrusted unless the server is trusted.75% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1059797API
curl https://kongchang.com/api/v1/knowledge/claims/1059797MCP
get_claim(id=1059797)