MCP Security: Poisoned Metadata, Routing, and MRTR State
Stateless does not mean trustless. It means every request exposes the evidence a server and gateway need to validate the call independently. Treat tool descriptions, annotations, client information, and server information as untrusted data. Detect metadata poisoning, descriptor changes, and cross-server name collisions. Validate the 2026-07-28 request metadata and Streamable HTTP routing headers. Protect MRTR requestState against tampering and bind confirmation to exact arguments. Apply authorization and rate limits to a principal, not a removed protocol session. A model reads tool descriptions to decide what to call. A router reads tool names to decide where to send a request. A user reads labels to decide what to approve. One malicious descriptor can target all three. The official MCP security guidance is direct: descriptions and annotations should be treated as untrusted unless they come from a trusted server. Even then, deployment trust can change. A server update, compromised package, registry mistake, or gateway merge can alter what the model sees. The current protocol also changes the security boundary. In 2026-07-28 there is no core handshake and no transport session. A security design that keys approval, rate limits, or audit history only by Mcp-Session-Id is not a current design. Use a concrete list instead of the vague instruction to be careful. Metadata poisoning. A description contains instructions unrelated to the declared tool…
MCP Security: Poisoned Metadata, Routing, and MRTR State: Stateless does not mean trustless. It means every request exposes the evidence a server and gateway…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.