🔐 Building Secure, Scalable Remote MCP Servers

Hardening the bridge between LLMs and sensitive data sources

MCP (Model Context Protocol) standardizes how LLMs connect to external tools and data sources. You don’t have to write one-off connectors for every API. But this flexibility means your server can be talking to anything from internal CRMs to finance systems which is great for capability and terrible for security if you cut corners.

Here’s how to design MCP servers that protect sensitive data, scale under unpredictable AI workloads, and stay maintainable.

---

What We Will Dive Into Today

• Why Security Comes First

• OAuth 2.1: The Foundation

• The Auth Flow in Practice

• Multi-Tenant HArdening

• Scaling With An AI Gateway

• Secrets Without Landmines

• Observability

• Source Article

---

🚨 Why Security Comes First

• Exfiltrate data at scale — because the server often has downstream access to multiple systems, not just its own data.

• Influence AI agent decisions — manipulating outputs by poisoning the context pipeline.

• Pivot into other infrastructure — using stolen credentials for databases, APIs, or internal tools.

The spec now includes guardrails against:

• Confused deputy attacks – Prevent a legitimate client from using your server to access data they shouldn’t. Mitigate by checking both the user identity and the resource scope on every request.

• Token passthrough vulnerabilities – Ensure tokens intended for one resource can’t be replayed on another. Resource-bound tokens (RFC 8707) are key here.

• Session hijacking – Protect with short token lifetimes, PKCE for OAuth flows, and always validating aud claims.

---

🛡 OAuth 2.1: The Foundation

MCP requires OAuth 2.1 for authorization, which lets you lean on decades of protocol hardening. You get:

• Authorization Server Discovery (RFC 9728 PRM) – MCP servers publish a .well-known/oauth-protected-resource endpoint. Clients that get a 401 can auto-discover where to authenticate.

• Dynamic Client Registration (RFC 7591) – Clients register themselves automatically, so you don’t need to manage a giant static client registry.

• Resource Indicators (RFC 8707) – Tokens are scoped to your MCP server’s resource ID, preventing reuse elsewhere.

If you build to spec, you don’t need to invent any new security primitives. OAuth libraries for most languages handle 80% of the work.

---

🔄 The Auth Flow in Practice

A protected MCP server handshake: