{"id":112464,"date":"2026-10-05T12:00:00","date_gmt":"2026-10-05T12:00:00","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=112464"},"modified":"2026-09-29T15:09:46","modified_gmt":"2026-09-29T15:09:46","slug":"how-to-secure-mcp-servers-database-access-control","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/data-security-privacy-compliance\/how-to-secure-mcp-servers-database-access-control\/","title":{"rendered":"How to secure MCP (Model Context Protocol) servers connected to your database – a practical guide"},"content":{"rendered":"\n

AI agents don’t ask permission before every query. Instead, they themselves decide which<\/em> tools to call and chain together. That’s a fundamentally different risk model than traditional access control – and it’s exactly why MCP (Model Context Protocol)<\/a> servers connected to databases need their own security playbook. <\/strong><\/p>\n\n\n\n

This guide covers the failure modes to watch for: confused deputy, token passthrough, prompt injection, over-scoped credentials, and session hijacking. Then, how to prevent<\/em> those failure modes – using authentication, authorization, and least-privilege controls.<\/strong><\/p>\n\n\n\n

How is MCP database access control different to conventional access control?<\/h2>\n\n\n\n

A Model Context Protocol (MCP)<\/a> server that connects to a database is the link between AI agents<\/a> and your data. Deploying one requires precise control of who gets which records. <\/strong><\/p>\n\n\n\n

Conventional access control<\/a> revolves around monitoring a person. Someone clicks a button, a system performs a permission check, and the action proceeds or fails.<\/p>\n\n\n\n

In MCP, on the other hand, an AI agent decides which tools to call, and in what order – without<\/em> human approval of each step. The agent can chain several tool calls and query a production database.<\/p>\n\n\n\n

What can go wrong without<\/em> database access control (the failure modes explained)<\/h2>\n\n\n\n

Let’s see what failure modes happen without<\/em> access control. Having these in mind allows us to follow access control far more easily.<\/p>\n\n\n\n

The ‘confused deputy’ problem<\/h4>\n\n\n\n

The server runs queries with its own privileges<\/a> instead of the initiator’s. The account on<\/em> the server can read entire tables, so a user who can only see their own rows can request everything. Click here<\/a> for more.<\/p>\n\n\n\n

Token passthrough<\/h4>\n\n\n\n

The server accepts a token and then forwards the unmodified one to the database. The MCP specification on authorization forbids this. The downstream system cannot confirm the token’s intended audience. Passthrough<\/a> also breaks audience checks, rate limits<\/a>, and auditing<\/a>.<\/p>\n\n\n\n

In-query prompt injection<\/h4>\n\n\n\n

Read-only mode is not a prevention for in-query prompt injection<\/a>. Malicious text stored in a row can instruct an agent to return out-of-reach data. The agent may comply even when it only runs read queries.<\/p>\n\n\n\n

Over-scoped credentials<\/h4>\n\n\n\n

A single account with deep permissions shared by every user gives every caller deep access.<\/p>\n\n\n\n

Session hijacking<\/h4>\n\n\n\n

Performing authentication<\/a> on a session identifier<\/a> lets an attacker replay or resume a given session (with the identifier). The security guidance for MCP advises against using session-based authentication.<\/p>\n\n\n\n

\n
\n\n

More essential reading on Simple Talk<\/strong>…<\/p>\n\n\n\n

Click here for Simple Talk’s full archive of security, privacy and compliance articles and guides.<\/a><\/p>\n\n<\/div>\n<\/div> \n\n\n

How does MCP authentication work?<\/h2>\n\n\n\n

Authentication in MCP is transport-dependent. Remote servers over HTTP<\/a> act as OAuth 2.1<\/a> resource servers, and a separate authorization server handles login and issues tokens. MCP servers then validate them.<\/strong><\/p>\n\n\n\n

The specification requires Proof Key for Code Exchange (PKCE)<\/a> with SHA-256<\/a>, HTTPS on every authorization endpoint, and strict redirect URI (Uniform Resource Identifier)<\/a> validation with two supported discovery mechanisms:<\/p>\n\n\n

\n