MCP Server Confused-Deputy
Accountability & GovernanceDescription
MCP server holds the agent's downstream-API credentials (e.g. an OAuth token to GitHub) and mediates calls. Agent requests a tool, server forwards to downstream API without re-validating that the *agent's* current authorisation context permits that specific operation. Server is "confused" — trusted by the agent, trusted by the downstream API, but doesn't enforce the join. Distinct from ZYR-SI-001 (spoofing) and ZYR-AU-006 (privilege creep) by location of failure: the confusion is in the server, not the agent or the auth system.
Server holds `repo` GitHub scope. Agent tool says "list public issues" but server forwards to `POST /repos/x/y/transfer` because the scope is broad enough and the server doesn't check the agent only asked for a list.
Security context loss in multi-agent AI handoffs is a logical consequence of stateless or poorly scoped inter-agent communication protocols, but empirical evidence from production multi-agent AI deployments documenting this failure is absent, as complex agentic pipelines with formal handoff semantics are still an emerging deployment pattern.
No public incident on record — evidence level: Theoretical
Primary mitigations
- Per-tool OAuth scope binding (one downstream scope per tool, no broad scopes)
- server-side caller validation before each downstream call
- per-request token introspection
- audit chain links agent → server → downstream call into a single span
Detection signals
MCP server requests broader OAuth scopes than its tools need; downstream API calls without preceding caller-scope-check log; mismatch between agent's asserted scope and the downstream operation