This isn’t new or novel. Replace “MCP” with any other technology that exposes sensitive or dangerous actions to 3rd parties. The solution is always the same: use fine grained permissions, apply the principle of least privilege, and think about your threat model as a whole; make sure things are auditable.

Here’s a nonexhaustive list of other technologies where we’ve dealt with these problems. The solutions keep getting reinvented:

- Browsers - Android Apps - GitHub actions - Browser extensions - <insert tool here> plugin framwork

Nothing about this is unique to MCP. It’s frustrating that we as a species have not learned to generalize.

I don’t think of this is a failure of the authors or users of MCP. This is a failure of operating systems and programming languages, which do not model privilege as a first class concept.