Keep MCP Multi-Tenant Auth Out of Context
Street_Inevitable_77 · reddit · 2026-07-13
While building a multi-tenant MCP server with private user data, the author discovered that **the hardest part isn't the tool itself, but keeping sensitive information completely out of the model's context**. The key lesson: **Identity and authentication must never be passed to the model as tool arguments**. Once user IDs, account IDs, or tokens enter tool parameters, they flow into the context window, risking being logged, reproduced in subsequent generations, or read/abused by prompt injections in other tools' outputs. The author argues that anything the model sees should not be considered a secret. Their summarized approach: - **Verify identity server-side per session**; the model should not directly carry identity info. - **Implement row-level isolation at the database layer**, using a fail-closed strategy to prevent leaks from missed permission checks. - **Tools should only return structured results computed server-side**, avoiding free text to reduce injection surfaces and token costs. Finally, the author treats the model as a "useful but untrusted client" and asks others how they handle per-call authentication and data isolation on the server side.
Related event: Pitfalls of Multi-Tenant Auth and Access Control in MCP(2 posts)→
More from coding & agent
- Why vector databases slow AI agents down after constant writes — PrajwalTomar_ · 2026-07-21
- A 13-minute GitHub Copilot video digs into prompt caching — lee_stott · 2026-07-21
- Codex turns out 123 screensavers in one playful batch — intellectronica · 2026-07-21
- SWE-Pruner Pro trims coding-agent context by up to 39% using the agent’s own states — pmttyji · 2026-07-21
- Autoresearch proposes packaging ML runs as studies with questions, analysis, and code diffs — morgymcg · 2026-07-21
- CHAP defines approvals, handoffs, and audit logs for human-agent workflows — DeliveryTechnical199 · 2026-07-21