MCP Security Interview Handbook: AuthZ, Tool Poisoning, and Tenant Isolation

MCP security interviews treat tool access as privileged execution. Interviewers probe authentication flows, per-user versus per-agent authorization, scoped tokens, and why static API keys embedded in MCP servers are unacceptable in multi-tenant products.

Tool poisoning and malicious resource content are realistic threats. Retrieved MCP resources can carry indirect prompt injection instructions. Candidates discuss content sanitization, trust tiers, separating instructions from data, and output policies that block exfiltration patterns.

Permission models should follow least privilege. Not every agent needs every tool; not every user session should inherit admin capabilities. Describe dynamic policy engines, approval workflows for high-risk tools, and audit logs that security teams can actually query.

Supply chain concerns extend to third-party MCP servers. Interviewers ask how you vet servers, pin versions, scan for credential leakage, and sandbox network egress. A compromised MCP server is equivalent to a compromised microservice with broad internal access.

Incident response playbooks matter. When an agent abuses a tool or leaks data through an MCP resource, how do you revoke sessions, rotate credentials, and replay traces to assess blast radius? Security maturity separates production platforms from demos.