Course description
Securing Agent Tools and MCP Servers teaches security engineers, AppSec and platform teams, ML engineers and security leaders to secure the tool layer of AI agents built on the Model Context Protocol. You will learn the MCP architecture, transports and authorization specification, and the threats specific to tools: tool poisoning and tool-description manipulation, shadowed and look-alike tools, rug pulls, over-broad scopes, token passthrough and the confused deputy, mapped to the MCP security guidance, OWASP and MITRE ATLAS. You will design controls that never trust the model (strict parameter validation, tools allowlisted per role, server-side authorization from the verified token, admin tools on a separate server, pinned tool definitions, sandboxed execution and a log line for every call), build them in five labs with the official MCP Python SDK, and prove with tests that a user session cannot reach an admin tool. The course ends with a tool security review and hardening plan for an MCP server you run or plan. Last verified 2026-11-03.
About this course
An agent is only as dangerous as the tools it can call, and the Model Context Protocol (MCP) has become a common way to hand tools to a model. This course teaches you to secure the server side: how MCP works and where trust sits, how tools go wrong (tool poisoning, shadowed and look-alike tools, rug pulls, over-broad scopes and the confused deputy), and the controls that hold even when the model is steered. Every control is taught as threat, control, verification and monitoring, grounded in the MCP specification and its Security Best Practices, the OWASP MCP Security Cheat Sheet and OWASP GenAI Security Project guides, NIST and MITRE ATLAS. In five labs you build and test a small server with the official MCP Python SDK, and you finish with a tool security review and hardening plan for a server of your own. The principles are vendor-neutral; where the course shows a control on ibl.ai, it links the live documentation.
What you will be able to do
- Explain the MCP architecture, its stdio and Streamable HTTP transports and the stateless 2026-07-28 revision, and locate the trust boundaries between the model, the client, the server and the systems a tool reaches.
- Recognize tool poisoning, shadowed and look-alike tools, rug pulls, over-broad scopes, token passthrough and the confused deputy by their preconditions and evidence, and map each to the MCP guidance, OWASP and MITRE ATLAS.
- Design server-side controls that never trust the model: strict schema validation, deny-by-default tools allowlisted per role, identity taken from the verified token, and admin tools separated by server, audience and scope.
- Build a small MCP server with the official Python SDK whose tools validate every parameter, refuse calls outside the caller's role and log every call, and prove with tests that a user session cannot reach an admin tool.
- Pin and review tool definitions, sandbox tool execution with verified restrictions, and turn audit logs into alert rules that are tested to fire and to stay quiet.
- Run a tool security review and write a hardening plan, with findings, owners, proving tests, a monitoring and response plan and a decision, for an MCP server you run or plan to run.
Who this course is for
Roles: security engineers, AppSec and platform teams, ML engineers and security leaders who build, run or approve MCP servers and the agents that call their tools.
Organizations: any sector that connects LLM applications or agents to internal systems, data or third-party services through MCP.
Before you start: familiarity with web and API security, OAuth basics and running Python from a terminal. The labs need Python 3.11 or later and run entirely on your own machine on 127.0.0.1, with synthetic data and fake tokens supplied in the course.
Format
Time: about 10 to 12 hours, self-paced. Level: intermediate to advanced. Hands-on: five labs on a local MCP server built with the official Python SDK, with an AI tutor that coaches each step from the output you paste.
Structure: a Start here section, four content sections of readings, worked examples, templates and hands-on defensive labs, each ending in an AI assessment, and a capstone in which you write a tool security review and hardening plan for your own MCP server, followed by a reading list.
Grading: the four section AI assessments count for 60 percent of the grade and the capstone assessment for 40 percent. The pass mark is 70 percent.
Currency
Last verified 2026-11-03 against the MCP specification revision 2026-07-28 and its security guides, the MCP Python SDK 2.3.0, the OWASP MCP Security Cheat Sheet, OWASP's Practical Guide for Secure MCP Server Development (version 1.0, February 2026) and Practical Guide for Securely Using Third-Party MCP Servers (version 1.0, October 2025), the OWASP Top 10 for LLM Applications 2025 and Top 10 for Agentic Applications for 2026, NIST AI 600-1, NIST AI 100-2e2025, MITRE ATLAS release 2026.10 and the ibl.ai documentation.
This field changes quickly. MCP publishes new specification revisions and SDK releases often, and OWASP and MITRE revise their guidance between releases. Check the current versions before relying on any page or template, and test only systems you own or are authorized to test. This course is training, not a security assessment of your systems.
Outline
Section 0 · Start here
- 0.1 Welcome and orientation
Section 1 · Map the MCP attack surface
- 1.1 How MCP works and where trust sits
- 1.2 How tools go wrong
- 1.3 Section 1 assessment
Section 2 · Design controls at the tool boundary
- 2.1 Controls inside the server
- 2.2 Controls around the server
- 2.3 Section 2 assessment
Section 3 · Build and test a hardened MCP server
- 3.1 Build the server
- 3.2 Prove it and watch it
- 3.3 Section 3 assessment
Section 4 · Review, monitor and respond
- 4.1 Review a server before you trust it
- 4.2 Operate it safely
- 4.3 Section 4 assessment
Section 5 · Capstone and wrap-up
- 5.1 Capstone: a tool security review and hardening plan
- 5.2 Capstone assessment
- 5.3 Reading list and next steps