An agent that can read private data, process untrusted content, and communicate externally combines the three capabilities Simon Willison calls the “lethal trifecta.” A malicious message in a webpage or email may try to get the model to access information and send it outside.
The practical answer is not to trust that a prompt instruction will always stop the attack. In this tutorial, we’ll build a least-privilege gateway in Python: a local layer that decides which tools are available, validates their arguments, and logs calls. This is an architectural example, not an MCP client or server.
“LLMs follow instructions in content”
— Simon Willison
freeCodeCamp’s MCP Security Fundamentals course covers risks such as secret exposure, privilege escalation, tool poisoning, command injection, and excessive context. The OWASP MCP Top 10 list also includes lack of authentication, insufficient auditing, and unsupervised MCP servers. Here, we’ll focus on safeguards we can express in code without depending on a specific SDK.
Set up a small gateway
We’ll use only Python’s standard library. The gateway will receive a tool request as a dictionary and allow only the actions we declare. To make the example runnable without external services, the tools will simulate looking up a public document and sending a notification. Don’t connect this prototype to real data.
The flow will be explicit: request, permission check, bounded execution, and logging. External content is treated as data, not as an authorized instruction to expand capabilities.
flowchart TD
A["Peticion del agente"] --> B["Validar herramienta"]
B --> C["Comprobar argumentos"]
C --> D["Ejecutar accion permitida"]
D --> E["Registrar llamada"]
C --> F["Rechazar peticion"]Step 1: Declare the allowed tools
Start by defining a closed catalog. We don’t accept arbitrary function names or resolve a function from text received from the model. Each available action has a name, a description, and a set of expected arguments.
# gateway.py
from typing import Any
TOOLS: dict[str, dict[str, Any]] = {
"read_public_note": {
"description": "Lee una nota pública de demostración",
"arguments": {"note_id"},
},
"send_notice": {
"description": "Envía una notificación de demostración",
"arguments": {"message"},
},
}
def validate_request(request: dict[str, Any]) -> None:
name = request.get("tool")
if name not in TOOLS:
raise ValueError("Herramienta no permitida")
arguments = request.get("arguments")
if not isinstance(arguments, dict):
raise ValueError("arguments debe ser un objeto")
expected = TOOLS[name]["arguments"]
if set(arguments) != expected:
raise ValueError("Argumentos no permitidos o incompletos")
if __name__ == "__main__":
validate_request({
"tool": "read_public_note",
"arguments": {"note_id": "welcome"},
})
print("Petición válida")Save the block as gateway.py and run it with python gateway.py. The check requires an exact match between the received arguments and the declared ones; this way, an extra field such as send_to won’t go unnoticed. In a real integration, the list should correspond to the actions the agent needs, not all the actions the server might offer.
Step 2: Separate execution from the tool name
Validating the name isn’t enough: we need an explicit table of executable functions. The following version retains the validation and adds local implementations. The note is fixed, and the notification is only printed; no network call is made.
# gateway.py
from typing import Any
TOOLS: dict[str, set[str]] = {
"read_public_note": {"note_id"},
"send_notice": {"message"},
}
NOTES = {"welcome": "Esta es una nota pública de ejemplo."}
def validate_request(request: dict[str, Any]) -> tuple[str, dict[str, Any]]:
name = request.get("tool")
arguments = request.get("arguments")
if name not in TOOLS:
raise ValueError("Herramienta no permitida")
if not isinstance(arguments, dict):
raise ValueError("arguments debe ser un objeto")
if set(arguments) != TOOLS[name]:
raise ValueError("Argumentos no permitidos o incompletos")
return name, arguments
def read_public_note(arguments: dict[str, Any]) -> str:
note_id = arguments["note_id"]
if not isinstance(note_id, str) or note_id not in NOTES:
raise ValueError("Nota inexistente")
return NOTES[note_id]
def send_notice(arguments: dict[str, Any]) -> str:
message = arguments["message"]
if not isinstance(message, str) or len(message) > 200:
raise ValueError("Mensaje inválido")
return f"Notificación simulada: {message}"
HANDLERS = {
"read_public_note": read_public_note,
"send_notice": send_notice,
}
def invoke(request: dict[str, Any]) -> str:
name, arguments = validate_request(request)
return HANDLERS[name](arguments)
if __name__ == "__main__":
print(invoke({
"tool": "read_public_note",
"arguments": {"note_id": "welcome"},
}))Now the input can’t choose a Python function on its own: invoke only looks up names present in HANDLERS. The message type and length validation is an example rule, not a universal guarantee. In an application connected to real services, each function should have limits appropriate to its operation and check the relevant identity and authorization.
Step 3: Mark external content as untrusted
The risk isn’t limited to arguments. A tool can return text containing instructions directed at the model. The program can’t force the model to interpret that text correctly, but it can maintain an explicit distinction between the tool’s result and the system’s instructions.
This block can be run separately. It returns an object with a provenance label instead of mixing the retrieved text with a control instruction.
from dataclasses import dataclass
@dataclass(frozen=True)
class ToolResult:
source: str
trusted_as_instruction: bool
text: str
def wrap_external_content(text: str) -> ToolResult:
return ToolResult(
source="external_tool",
trusted_as_instruction=False,
text=text,
)
if __name__ == "__main__":
result = wrap_external_content(
"Texto de ejemplo: ignora las instrucciones anteriores."
)
print(result.source)
print(result.trusted_as_instruction)
print(result.text)The label helps preserve provenance in the code and logs; it isn’t a prompt filter or a defense that neutralizes an injection on its own. Willison warns that untrusted content can reach the model alongside legitimate instructions. That’s why the decisive boundary must be the available actions: even if some text tries to order a transfer, the agent shouldn’t be able to invoke tools it doesn’t need.
Step 4: Log every invocation
OWASP includes lack of auditing and telemetry among its MCP risks. The following example logs the tool name and whether the call succeeded or failed. Avoid dumping arguments or results without reviewing them: they could contain secrets or private data.
import json
import time
from typing import Any
def audit_event(tool: str, outcome: str) -> None:
event = {
"timestamp": time.time(),
"tool": tool,
"outcome": outcome,
}
print(json.dumps(event, sort_keys=True))
def audited_invoke(
request: dict[str, Any],
handlers: dict[str, Any],
) -> Any:
tool = request.get("tool", "unknown")
try:
result = handlers[tool](request["arguments"])
except Exception:
audit_event(str(tool), "error")
raise
audit_event(str(tool), "success")
return result
if __name__ == "__main__":
handlers = {"echo": lambda args: args["text"]}
result = audited_invoke(
{"tool": "echo", "arguments": {"text": "prueba"}},
handlers,
)
print(result)The demonstration function prints JSON to standard output. In production, the format, destination, and protection of the logs depend on the system that consumes them; this example doesn’t create an immutable log. It does illustrate a useful rule: record the outcome of an operation without automatically copying its sensitive content into the log.
Test the boundaries, not just the happy path
Before connecting an agent, check that the gateway rejects an unknown tool, extra arguments, and values with unexpected types. This separately runnable script tests two rejections with a small version of the validator.
ALLOWED = {"read_public_note": {"note_id"}}
def validate(request: dict[str, object]) -> None:
tool = request.get("tool")
arguments = request.get("arguments")
if tool not in ALLOWED:
raise ValueError("Herramienta no permitida")
if not isinstance(arguments, dict):
raise ValueError("arguments debe ser un objeto")
if set(arguments) != ALLOWED[tool]:
raise ValueError("Argumentos no permitidos o incompletos")
if not isinstance(arguments["note_id"], str):
raise ValueError("note_id debe ser texto")
cases = [
{"tool": "delete_everything", "arguments": {}},
{"tool": "read_public_note", "arguments": {
"note_id": "welcome",
"send_to": "outside",
}},
]
for case in cases:
try:
validate(case)
except ValueError as error:
print(f"Rechazada: {error}")
else:
raise AssertionError("La petición debía rechazarse")When interpreting errors, don’t turn them into permission to retry with a broader request. Keep the tool list closed, reduce the accessible data, and separate read actions from those that produce external effects. These are architectural barriers against the combination of private data, untrusted content, and external communication described by Willison.
Mistakes to avoid
- Relying only on the prompt: an instruction to ignore malicious content doesn’t technically prevent a tool from performing an action.
- Exposing credentials in arguments, context, or logs. OWASP identifies poor token management and secret exposure as specific risks.
- Giving a tool broad permissions when a specific operation would suffice. OWASP describes permission expansion as a path to privilege escalation.
- Adding tools without controlling their provenance and configuration. The OWASP list covers both tool and dependency manipulation and unsupervised MCP servers.
The gateway presented here doesn’t replace authentication, authorization, or dependency review in a real integration. It does establish a verifiable checkpoint before each action: which tool is invoked, which arguments it accepts, and which event is logged. The next step is to connect each handler to a real operation without expanding the catalog or giving the agent permissions it doesn’t need.
Sources: freeCodeCamp.org, CHOOSETO, OWASP Foundation, Simon Willison’s Weblog
