How to secure MCP (Model Context Protocol) servers connected to your database – a practical guide

Redgate's guide to securing MCP (Model Context Protocol) servers connected to databases details practical steps to stop confused‑deputy attacks, token passthrough, and prompt injection by enforcing proper authentication and least‑privilege access. For website owners that expose AI‑driven services—such as chat widgets, recommendation engines, or search assistants—this means the same attack vectors can be leveraged against their own llms.txt endpoints. An attacker who can hijack a token or inject malicious prompts into a Model Context Protocol call could bypass the llms.txt whitelist, masquerade as a trusted bot, and scrape content or manipulate responses. Consequently, any site that allows AI models to query back‑end data must treat MCP connections as a high‑risk surface and align their bot‑filtering rules with the hardened authentication flow described by Redgate. **Actionable tips:** 1. **Restrict MCP token propagation** – Configure your llms.txt file to allow only specific user‑agent strings and IP ranges for MCP traffic, and reject any request that presents a token not issued by your OAuth provider. 2. **Enable prompt‑validation middleware** – Deploy a server‑side filter that sanitizes incoming prompts before they reach the model, logging any attempts that contain injection patterns for later analysis. 3. **Monitor bot signatures** – Use llms.txt‑compatible analytics to flag abnormal request rates from MCP endpoints and automatically rotate credentials when suspicious activity is detected.