Keep MCP Multi-Tenant Auth Out of Context
Street_Inevitable_77 · reddit · 2026-07-13
While building a multi-tenant MCP server with private user data, the author discovered that the hardest part isn't the tool itself, but keeping sensitive information completely out of the model's context.
The key lesson: Identity and authentication must never be passed to the model as tool arguments. Once user IDs, account IDs, or tokens enter tool parameters, they flow into the context window, risking being logged, reproduced in subsequent generations, or read/abused by prompt injections in other tools' outputs. The author argues that anything the model sees should not be considered a secret.
Their summarized approach:
- Verify identity server-side per session; the model should not directly carry identity info.
- Implement row-level isolation at the database layer, using a fail-closed strategy to prevent leaks from missed permission checks.
- Tools should only return structured results computed server-side, avoiding free text to reduce injection surfaces and token costs.
Finally, the author treats the model as a "useful but untrusted client" and asks others how they handle per-call authentication and data isolation on the server side.
Related event: Pitfalls of Multi-Tenant Auth and Access Control in MCP(2 posts)→
More from coding & agent
- Team demos AI agent Blender skills with impressive 3D results — noahsolomon · 2026-10-26
- A 13KB Markdown file can hijack Claude Code and Codex via your Downloads folder — pbaylies · 2026-10-26
- A Fallback for an Auto-Posting Bot: Silence Is the Default, Posting Is the Exception — petrusenko_max · 2026-10-26
- Claude Code can now edit videos: a 10-prompt workflow from raw footage to final cut — TawohAwa · 2026-10-26
- Developer Moves All Prompts to Skills: AI Coding Workflow v3 Explained — rseroter · 2026-10-26
- charlie Marsh: rewrites beat external deps in the AI era — mohamedmansour · 2026-10-26