# Securing MCP Servers with Scoped OAuth and Per-Agent Permission Limits

_By Tayyab Mughal, Founder & AI Chief · 24 August 2026 · 2 min read_

> A practical guide to securing Model Context Protocol servers against tool hijacking, prompt injection, and unauthorized data exfiltration using scoped OAuth tokens.

As AI agents gain access to email, databases, and internal APIs via MCP, securing the server against prompt injection and privilege escalation is essential. Here is the defense architecture.

## The Threat Model: MCP Tool Hijacking and Privilege Escalation

When an AI agent reads external data (such as incoming emails, customer webhooks, or PDF attachments), malicious actors can embed indirect prompt injections instructing the agent to invoke MCP tools with attacker-controlled arguments.

If your email MCP server does not enforce cryptographic allowlists and scoped execution limits, an injected prompt can order the model to exfiltrate private API keys or email confidential customer data.

## Implementing Scoped OAuth Token Verification in MCP

Every MCP tool call must authenticate with short-lived tokens carrying fine-grained permission scopes (e.g. email:send:transactional vs email:admin).

```typescript
import jwt from 'jsonwebtoken';

interface McpSecurityContext {
  agentId: string;
  allowedDomains: string[];
  maxDailySends: number;
  requiresHumanApproval: boolean;
}

export function verifyMcpToken(token: string): McpSecurityContext {
  const secret = process.env.MCP_JWT_SECRET!;
  try {
    const decoded = jwt.verify(token, secret) as any;
    return {
      agentId: decoded.sub,
      allowedDomains: decoded.allowed_domains || [],
      maxDailySends: decoded.daily_limit || 50,
      requiresHumanApproval: decoded.approval_mode ?? true,
    };
  } catch (err) {
    throw new Error('Invalid or expired MCP security context token');
  }
}
```

## The 4 Golden Rules of Production MCP Security

- 1. Never expose raw SQL or arbitrary shell tools alongside email tools in the same agent context.
- 2. Enforce physical recipient allowlists at the tool execution layer, not in the prompt.
- 3. Sign every outgoing payload with an audit trail hash linking the message to the generating agent ID.
- 4. Limit token lifetimes to 15 minutes with automatic refresh rotation.

---

_Tags: MCP, Security, OAuth, AppSec_