# Why MCP security is about permissions overhaul

DevFeed: [Why MCP security is about permissions overhaul](<https://devfeed.tech/articles/why-mcp-security-is-about-permissions-overhaul-9225.md>)

Original publisher: [Read original article](<https://webflowmarketingmain.com/blog/mcp-security>)

Author: Mohit Bansal

Published: 2026-09-09T00:00:00Z

Content type: article

Language: en

Sources: [Webflow Blog](<https://devfeed.tech/sources/webflow-blog.md>)

Topics: [Model Context Protocol (MCP)](<https://devfeed.tech/topics/model-context-protocol-mcp.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [anthropic](<https://devfeed.tech/topics/anthropic.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [anthropic](<https://devfeed.tech/tags/anthropic.md>), [github](<https://devfeed.tech/tags/github.md>), [identity](<https://devfeed.tech/tags/identity.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>)

## AI overview

MCP security failures often arise from over-scoped credentials and weak permission boundaries rather than protocol bugs. The article examines prompt injection, tool poisoning, and confused deputy risks, and argues for redesigning access around the minimum permissions each task requires.

## Source excerpt

Most MCP breaches trace back to over-scoped credentials, not broken code. Here's what a real permissions redesign checks for.