MCP Server Security Best Practices: Token Scoping, Permissions, and Access Control

Strapi’s MCP server, available from version 5.47.0, enables AI agents to create, update, delete, and publish CMS content through a stateless `/mcp` endpoint authenticated with Admin tokens, making careful permission design essential. Each request is independently authorized, and Strapi applies four layers of protection—tool visibility, field filtering, locale filtering, and runtime document checks—so agents only see and access capabilities permitted by their token. The guidance emphasizes issuing separate, tightly scoped tokens for each AI client or use case, favoring read-only access, restricting publishing rights, and using ownership-based conditions where writing is necessary to limit the impact of token theft, prompt injection, or agent mistakes. Tokens should be stored outside source control in environment variables or dedicated secrets managers, rotated regularly, and served only over HTTPS behind a reverse proxy with network restrictions, while development servers should remain local and unexposed. Revocation and permission changes apply on the next request because no session state persists, and teams can monitor agent-originated content changes through Enterprise Audit Logs tagged with `origin: mcp` or through proxy logging where those logs are unavailable.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.