MCP is INSECURE - Here's Why and How to Fix it

Key Concepts

• MCP Servers: A type of server that provides access to various tools and resources.
• Security Risks: Potential vulnerabilities associated with MCP servers.
• Sensitive Data Exposure: The risk of unauthorized access to confidential information.
• Excessive Permissions: Granting users more access than they require.
• Auditability/Traceability: The ability to track and review usage of MCP servers.
• Plain Text Secrets: Storing sensitive information like API keys in an unencrypted format.
• OAuth: An authorization framework that does not inherently solve the problem of storing long-lived, overly permissive tokens.
• Granular Permissioning: The ability to define specific access levels for users.
• Enterprise-Grade Platform: A robust solution designed for business environments.
• Teleport: A platform that addresses MCP server security risks by providing secure configuration, auditability, and granular permissioning.
• Protected and Observable Resources: MCP servers managed and monitored by Teleport.
• Just-In-Time (JIT) Tokens: Temporary access tokens with limited permissions.
• Proxy: A system that intercepts and manages requests, adding security layers.
• Audit Log: A record of all MCP calls, including details like server, tool, and parameters.
• Zero Trust Access: A security model that assumes no implicit trust and verifies every access request.

Security Risks of MCP Servers and Solutions

The video discusses the prevalent perception of MCP servers as both beneficial and a significant security risk. The primary risks identified are:

1. Exposing Sensitive Data: MCP servers often grant users more access than they actually need, increasing the likelihood of accidental or malicious data exposure.
2. Lack of Auditability and Traceability: The absence of clear logs and tracking mechanisms for MCP server usage makes it difficult to monitor who accessed what and when, hindering security investigations and compliance efforts.
3. Storing Secrets in Plain Text: A common practice involves storing sensitive credentials, such as personal access tokens (PATs) for services like GitHub, directly in configuration files in plain text. This is a critical vulnerability.

Example: GitHub MCP Server Vulnerabilities

The presenter uses the GitHub MCP server as a case study to illustrate these risks:

• Plain Text Secrets: The configuration file for the GitHub MCP server contained a redacted personal access token stored in plain text. The presenter emphasizes that this should not be necessary.
• OAuth Limitations: While OAuth is mentioned, it's clarified that it doesn't solve the core issue of storing long-lived, overly permissive tokens on a local machine.
• Excessive Permissions: The MCP client connected to the GitHub MCP server had access to nearly all possible capabilities within GitHub. There is no built-in mechanism to restrict these permissions, for instance, to provide a teammate with only read access. The presenter states that extensive searching revealed no native solutions for this granular permissioning.

The Need for an Enterprise-Grade Platform

The presenter argues that addressing these MCP server security issues requires an "enterprise-grade platform" capable of providing:

• Secure Configuration: Ensuring that sensitive information is not exposed.
• Auditability: Maintaining detailed logs of all server interactions.
• Granular Permissioning: Allowing for precise control over user access levels.

Teleport as a Solution

The video introduces Teleport as a platform that offers these essential security features for MCP servers.

How Teleport Works with MCP Servers:

1. Protected and Observable Resources: Each MCP server is treated as a resource that is both protected and observable within the Teleport platform.
2. Login to Teleport: Users log into Teleport first.
3. Just-In-Time (JIT) Tokens: Upon successful authentication with Teleport, users are issued a JIT token. This token has only the specific permissions required for their account and the immediate task.
4. Secure Configuration: The MCP client configuration no longer needs to store secrets, as Teleport handles the authentication and authorization.
5. Seamless Integration: Connecting MCP servers to applications through Teleport is described as being as easy, if not easier, than traditional methods.
6. Proxying Requests: All requests to the MCP server, even when using the underlying GitHub MCP server as an example, are routed through Teleport. Teleport acts as a proxy, enforcing security policies and providing the necessary protections.

Teleport's Security Features in Action:

• Audit Log: Within the Teleport platform, users can access a comprehensive audit log. This log records all MCP calls, including details such as the server accessed, the tool used, and even individual parameters.
• Agent-Based Analysis: Teleport includes agents that can analyze the audit log data to identify anomalies and outliers, further enhancing security monitoring.
• Zero Trust Access Management: Teleport enables the management of roles for MCP servers. Administrators can configure the specific tools that users assigned to a particular role can access on the servers.

Conclusion and Recommendation

The presenter highly recommends checking out Teleport, providing a link in the description. They express gratitude to the Teleport team for their collaboration in presenting these critical security issues. The core takeaway is that while MCP servers offer valuable functionality, their inherent security risks necessitate a robust, enterprise-grade solution like Teleport to ensure secure configuration, comprehensive auditability, and granular control over access.