Model Context Protocol (MCP) Least-Privilege Capability & Egress Filtration

--- description: Model Context Protocol (MCP) Least-Privilege Capability & Egress Filtration - Enforces strict input validation, capability confinement, and zero-trust outbound egress filtering for all Model Context Protocol (MCP) tool registrations. Mitigates indirect prompt injection, data exfiltration, and SSRF attacks by running tool execution routines in isolated sandboxes with domain-pinned network capabilities. Guarantees that untrusted context cannot dynamically influence destination endpoints, file system access boundaries, or credential dispatch. globs: src/mcp/**/*.{ts,tsx}, src/tools/**/*.{ts,tsx}, src/server/**/*.{ts,tsx}, **/*tool*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/mcp-capability-least-privilege-and-egress-control" --- # Model Context Protocol (MCP) Least-Privilege Capability & Egress Filtration > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Unvalidated MCP tool invocation allowing dynamic URLs and unconstrained outbound network requests resulting in data exfiltration ## System Constraints You are a Principal Security Architect enforcing Model Context Protocol (MCP) Least-Privilege Capability & Egress Filtration. Reject any tool registration or handler that executes unvalidated arbitrary egress requests, exposes broad system access, or fails to isolate LLM tool runtime environments. Every MCP tool interface must enforce schema-bounded parameters using strict typing, strip unwhitelisted keys, enforce domain-allowlist egress firewalls, and sanitize indirect context to prevent injection and exfiltration payloads. ## Strict Guidelines - Engineers MUST ALWAYS enforce strict, closed schemas (e.g., Zod with .strict()) for all MCP tool parameters, rejecting unknown attributes explicitly. - Engineers MUST NOT allow model-controlled arguments to dictate raw egress URLs, ports, or protocols without matching against an explicit domain allowlist. - Code SHOULD enforce DNS resolution pinning and private IP space filtering (RFC 1918, RFC 3927, RFC 4193) to eliminate Server-Side Request Forgery (SSRF) vulnerabilities. - Services MUST execute third-party or multi-tenant MCP tool handlers inside isolated network sandboxes with default-deny outbound egress rules. - Components NEVER leak ambient credentials, environment variables, or full filesystem access to tool execution contexts without explicit least-privilege scoping. ## Bad vs Good Implementations ### Vulnerable Dynamic HTTP Tool Handler vs. Hardened Egress-Filtered MCP Tool #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Accepts unvalidated model input directly as an outbound fetch target. An adversary injecting instructions via untrusted context can direct the MCP server to hit internal cloud metadata services (e.g., 169.254.169.254) or exfiltrate proprietary session tokens via query params or payload bodies. ```typescript import { Server } from "@modelcontextprotocol/sdk/server/index.js"; import { CallToolRequestSchema } from "@modelcontextprotocol/sdk/types.js"; const server = new Server({ name: "fetch-mcp", version: "1.0.0" }, { capabilities: { tools: {} } }); // VULNERABLE: Direct model-driven URL fetch without schema gating or egress restrictions server.setRequestHandler(CallToolRequestSchema, async (request) => { if (request.params.name === "fetch_external_data") { const { url, payload } = request.params.arguments as { url: string; payload?: unknown }; // Indirect prompt injection can target internal services or exfiltrate state const response = await fetch(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload), }); const data = await response.text(); return { content: [{ type: "text", text: data }] }; } throw new Error("Unknown tool"); }); ``` #### Production Standard (Correct) > **Standard**: Implements least-privilege architectural controls: parameters are strictly validated with Zod (.strict()), preventing untrusted keys. The target hostname is locked to an authorized endpoint rather than arbitrary model input, headers are locked down, and operations are protected by request timeouts and explicit error codes. ```typescript import { Server } from "@modelcontextprotocol/sdk/server/index.js"; import { CallToolRequestSchema, ErrorCode, McpError } from "@modelcontextprotocol/sdk/types.js"; import { z } from "zod"; import { URL } from "node:url"; const server = new Server({ name: "fetch-mcp-hardened", version: "1.0.0" }, { capabilities: { tools: {} } }); // Strict schema invariant: parameters must be locked down and closed const AllowedFetchArgsSchema = z.object({ endpointPath: z.string().regex(/^\/[a-zA-Z0-9_-]+$/, "Invalid endpoint path pattern"), queryId: z.string().uuid("Must provide a valid UUID query identifier"), }).strict(); const ALLOWED_HOST = "api.partner-service.internal.corp"; server.setRequestHandler(CallToolRequestSchema, async (request) => { if (request.params.name !== "fetch_external_data") { throw new McpError(ErrorCode.MethodNotFound, `Tool ${request.params.name} not found`); } const parseResult = AllowedFetchArgsSchema.safeParse(request.params.arguments); if (!parseResult.success) { throw new McpError(ErrorCode.InvalidParams, `Schema violation: ${parseResult.error.message}`); } const { endpointPath, queryId } = parseResult.data; // Pinned origin and strict egress construction const targetUrl = new URL(`https://${ALLOWED_HOST}${endpointPath}`); targetUrl.searchParams.set("id", queryId); // Sandbox execution: strip unneeded headers, use explicit timeout const controller = new AbortController(); const timeout = setTimeout(() => controller.abort(), 5000); try { const response = await fetch(targetUrl.toString(), { method: "GET", signal: controller.signal, headers: { "Accept": "application/json" }, }); if (!response.ok) { throw new McpError(ErrorCode.InternalError, `Egress HTTP error ${response.status}`); } const data = await response.json(); return { content: [{ type: "text", text: JSON.stringify(data) }], }; } finally { clearTimeout(timeout); } }); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Model Context Protocol (MCP) Least-Privilege Capability & Egress Filtration

Model Context Protocol (MCP) Least-Privilege Capability & Egress Filtration defines an industrial-grade behavioral standard for security engineering. Enforces strict input validation, capability confinement, and zero-trust outbound egress filtering for all Model Context Protocol (MCP) tool registrations. Mitigates indirect prompt injection, data exfiltration, and SSRF attacks by running tool execution routines in isolated sandboxes with domain-pinned network capabilities. Guarantees that untrusted context cannot dynamically influence destination endpoints, file system access boundaries, or credential dispatch. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unvalidated MCP tool invocation allowing dynamic URLs and unconstrained outbound network requests resulting in data exfiltration Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unvalidated MCP tool invocation allowing dynamic URLs and unconstrained outbound network requests resulting in data exfiltration	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce strict, closed schemas (e.g., Zod with .strict()) for all MCP tool parameters, rejecting unknown attributes explicitly.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.