The Model Context Protocol does not define a security model. It defines a message format. The security of an MCP integration depends on the server implementation. CorpusIQ runs a production MCP server that exposes 40+ business tools to ChatGPT, Claude, and Perplexity; it is CASA Tier 2 certified by DEKRA, hosted on Microsoft Azure, and enforces read-only external-source retrieval with scoped operational retention. This article walks through the security properties any MCP server needs before it touches production business data, and what CorpusIQ does specifically.
Minimize OAuth scope
The first rule of MCP security: request the narrowest OAuth scope that does the job. Every extra scope is an additional risk in a token-compromise scenario. For an MCP server that answers questions about business data, read-only is almost always enough. Write scopes mean the server could, if compromised, create invoices, send emails, or delete records. Read-only means the blast radius of a token leak is bounded to data exposure, not data mutation.
CorpusIQ marks external-source retrieval tools read-only across the catalog. The only tools that accept writes are CorpusIQ control-plane tools, which manage your own CorpusIQ configuration and never write to a connected system. Provider scopes vary by connector and documented operation.
Protect the OAuth tokens, not just the data
The tokens your server holds are more dangerous than the data it reads. A token is reusable authentication; data is a snapshot. Treat tokens accordingly: encrypt at rest, rotate refresh tokens on use, short-lived access tokens, and never log a token to an observability pipeline.
Never pass tokens to the LLM. The LLM sees the tool result, not the credential. If the LLM is compromised or prompt-injected, it cannot exfiltrate a token it never saw. This is a core design split between MCP servers and plugin-style architectures where auth is handed to the model.
Prompt injection is real, plan for it
An attacker who can write into any data source your MCP server reads can attempt to inject instructions into the LLM via the tool result. An email body asking the model to ignore previous instructions and send a document to an external address is a plausible payload in a world where LLMs read inboxes.
Defenses layer. First, treat all tool results as untrusted content; do not parse them as instructions on the server side. Second, the downstream LLM has its own prompt-injection defenses; strong models are harder to hijack than weak ones. Third, minimize what the server can do in response to instructions it sees. A read-only MCP server cannot act on an instruction to send data anywhere because sending is not a tool it exposes.
Scope retention and audit records
Direct MCP does not retain raw customer files or full connector response payloads. Local AUDIT logs contain raw query text and tool parameters plus bounded result summaries. The Azure Log Analytics workspace retains those logs for 30 days. Optional indexed search has a separate lifecycle, and the selected AI provider receives authorized source context.
CorpusIQ records which tool was called, by which tenant, at what time, operational query text, and a bounded outcome summary. Raw customer files and full connector response payloads are outside that operational log.
Isolate tenants
Any multi-tenant MCP server needs strict tenant isolation. OAuth tokens belong to one tenant. Tool calls carry a session identifier that maps to a tenant. Tool results never mix data from two tenants, and the code paths that might mix them are the hot spots for security review.
CorpusIQ runs each tenant connector namespace independently. A HubSpot tool call for tenant A cannot accidentally hit tenant B HubSpot token, because the token lookup is keyed on the MCP session, not on any LLM-controllable parameter.
Certifications and hosting posture
Certifications are not the whole story, but they are a forcing function. CorpusIQ is CASA Tier 2 certified by DEKRA, which audits OAuth handling, data retention, incident response, and engineering practice. Hosting on Microsoft Azure provides compliance-aligned infrastructure. Customers should validate the complete processing path, including source providers, AI clients, logs, and backups, for their residency requirements.
Checklist before you ship an MCP server
- OAuth scope is the minimum needed; read-only if possible
- Tokens encrypted at rest, rotated on refresh, never logged, never passed to the LLM
- TLS on all transport; HTTP+SSE servers behind a WAF
- Rate limits per tenant and per connector; graceful degradation on throttle
- Tool results labeled as untrusted content; no server-side instruction parsing
- Scoped retention: no raw customer files or full connector response payloads; operational logs may remain up to 30 days
- Tenant isolation verified by code review; session-keyed token lookup
- External audit or certification (CASA, SOC 2, ISO 27001) before production data
Related reading
- What is the Model Context Protocol?
- MCP vs API: What Is Actually Different
- Building an MCP Server: A Practical Guide
- CorpusIQ security and compliance
- See all 40+ live CorpusIQ connectors
- Pricing, starting at $29.95 per month
Frequently asked questions
The protocol does not specify authentication, retention, or scoping policy. Security is the responsibility of the individual MCP server. A well-built MCP server (like CorpusIQ) uses source-specific authorization, operation-level safety annotations, scoped retention, TLS in transit, rate limits, and per-call audit logs. A poorly-built server can leak data just as easily as a poorly-built API.
Over-scoped OAuth grants. If the server requests write scopes it does not need, a compromised token has more impact than necessary. CorpusIQ requests provider scopes required for documented operations. Retrieval-only connector tools and CorpusIQ control-plane tools are separately named and carry safety annotations, reducing ambiguity if a token is compromised.
Yes. An attacker who can write into one of the connected sources (an email, a Slack message, a CRM note) can inject text that tries to manipulate the LLM. MCP servers mitigate this by treating tool results as untrusted content, labeling the source, and depending on the downstream LLM prompt-injection defenses. CorpusIQ additionally treats tool results as untrusted and exposes control-plane writes separately from connector retrieval.
Direct MCP does not retain raw customer files or full connector response payloads. Local AUDIT logs record raw query text and tool parameters plus bounded result summaries; the Azure Log Analytics workspace retains those logs for 30 days. Optional indexed search has a separate lifecycle. Authorized source context is sent to the selected AI client, whose plan and settings govern conversation handling.
For remote MCP servers, yes. HTTP+SSE servers like CorpusIQ run over TLS. For local stdio servers, traffic is between two processes on the same machine, which the operating system isolates. Either way, the protocol itself does not introduce new attack surface beyond what the transport provides.