AI and LLMs · Senior · Question 28 of 75
How should authorization work for MCP tools that act on a user's data?
- 1The server checks the end user's rights, not just the client's
- 2Any client that connects can act as any user it names
- 3Authorization is handled by the model in its reasoning
Show the answer
Correct answer: The server checks the end user's rights, not just the client's
Explanation
The model must never be the security boundary. OAuth-style delegated access and server-side checks keep actions within the user's rights.