Keep MCP Multi-Tenant Auth Out of Context
Street_Inevitable_77 · reddit · 2026-07-13
While building a multi-tenant MCP server with private user data, the author discovered that the hardest part isn't the tool itself, but keeping sensitive information completely out of the model's context.
The key lesson: Identity and authentication must never be passed to the model as tool arguments. Once user IDs, account IDs, or tokens enter tool parameters, they flow into the context window, risking being logged, reproduced in subsequent generations, or read/abused by prompt injections in other tools' outputs. The author argues that anything the model sees should not be considered a secret.
Their summarized approach:
- Verify identity server-side per session; the model should not directly carry identity info.
- Implement row-level isolation at the database layer, using a fail-closed strategy to prevent leaks from missed permission checks.
- Tools should only return structured results computed server-side, avoiding free text to reduce injection surfaces and token costs.
Finally, the author treats the model as a "useful but untrusted client" and asks others how they handle per-call authentication and data isolation on the server side.
Related event: Pitfalls of Multi-Tenant Auth and Access Control in MCP(2 posts)→
More from coding & agent
- agents-best-practices: a provider-neutral Agent Skill for designing and auditing agentic harnesses — tom_doerr · 2026-09-11
- Cognition's SWE-2 uses a KKT duality argument in RL to shift the effort Pareto curve — YouJiacheng · 2026-09-11
- First-ever Three.js Conference lands in Paris, with a panel on AI-shortened design workflows — OdinLovis · 2026-09-11
- Data engineering, not agent frameworks, is the real bottleneck for enterprise AI agents — dhruv2038 · 2026-09-11
- RTK Terminal Compression Cuts Tokens but Leaves Your AI Coding Bill Unchanged — Bartaseth · 2026-09-11
- GPT-6 Astra beats Factorio with enemies in 44 in-game hours at ~$4,500 API cost — liminal_bardo · 2026-09-11