Model Context Protocol is fast becoming the default way AI agents connect to tools and data. But the protocol does not enforce security on its own, and assuming the client, gateway, or agent will draw those boundaries for you is a mistake. The server has to own them.

This is a first-timer's guide from a security engineer and OWASP GenAI Security Project contributor on securely building MCP servers, treating security as part of the build, not a bolt-on. It shares decisions that only become obvious after you ship one: choosing a transport (local stdio vs remote) and what it exposes, and why a few high-leverage tools beat a long list of narrow ones.

Security runs through each choice: treating tool descriptions and outputs as untrusted, executable context, defaulting to read-only, allow listing only the write paths you need, validating every input, and keeping secrets out of responses. The goal is a server that is safe by default, even when the client around it is not.