Securing an MCP server for agentic commerce.

1. Authenticate the agent, not just the shopper

Every request to the server must carry a verifiable identity for the calling agent.

Issue per-integration credentials (OAuth client credentials or signed API keys), never a shared secret. Bind each token to a single agent integration so you can revoke one without breaking the rest, and record which agent identity made every call. Short-lived tokens with rotation beat long-lived static keys; a leaked static key is a standing liability.

2. Give each tool least privilege

A tool should be able to do exactly one thing and reach exactly the data it needs.

Scope read tools to read and write tools to write; never expose an admin or bulk-export capability over MCP. The account the server runs as should hold the minimum database and API permissions the exposed tools require - not the permissions of a store owner. If search_products only needs published catalog rows, it must not be able to read customer records or draft pricing.

3. Treat every agent argument as untrusted input

Validate every argument server-side, including values that look like they came from the shopper.

An agent can be prompt-injected by a web page, a review, or its own context, so an argument that reads like a product ID may be an attack. Enforce types and ranges at the boundary, allow-list enum values, and never let free text reach a SQL query, a shell, or a downstream API without parameterization. Prompt injection is the injection class of this era; the defense is the same as it always was - do not trust the caller.

4. Authorize money movement with scoped tokens

A checkout tool should never hold a reusable payment credential.

Use a scoped payment token that authorizes one transaction, up to a set amount, with a short expiry. If the token leaks, the blast radius is a single capped purchase rather than a card on file. Keep yourself the merchant of record so the customer relationship, refund path, and liability stay where they belong. Our agentic checkout product implements this end to end.

5. Rate-limit and cap by agent

Per-agent limits stop one integration from draining data or hammering checkout.

Set request-rate limits per credential, and business caps on top of them - a maximum order value, a maximum quantity per line, a ceiling on searches per minute. Agents retry and parallelize far more aggressively than humans click, so a limit sized for a person will not hold. Fail closed: when a cap is hit, refuse the call rather than degrade silently.

6. Log every call for audit and attribution

You cannot secure or attribute what you did not record.

Write a structured log line for every tool call: agent identity, tool, arguments, decision, and result. This is your incident-response trail and, separately, the basis of server-side AI attribution - the only reliable way to know which agent surface drove which order, since most agent-driven traffic is invisible in standard analytics.

7. Confirm high-stakes actions

Irreversible or high-value actions should require an explicit confirmation step.

Purchases, cancellations, and refunds are the actions where a wrong agent decision costs real money. Return a confirmation object the agent must echo back, or gate the action behind a shopper approval, so a single mis-reasoned step cannot place an order. The protocol supports a confirm-then-execute pattern; use it for anything you would not want done by accident.

8. The pre-launch checklist

Do not expose an MCP server publicly until every line below is true.

• Per-integration credentials, short-lived and rotatable, revocable one at a time.
• Each tool scoped to least privilege; no admin, no bulk export over MCP.
• Server-side validation on every argument; free text never reaches a query or shell.
• Scoped payment tokens for checkout; you remain the merchant of record.
• Per-agent rate limits and business caps that fail closed.
• Structured audit log on every call, retained and monitored.
• Confirmation gate on purchases, cancellations, and refunds.
• A tested revocation path for a compromised agent credential.

If hand-rolling all eight is more than you want to own, MCP App Builder ships a compliant server with these controls built in, and the glossary defines every term used here.