01 / The operating case
What changes in a real workflow?
A team adds a public connector that advertises read-only analytics while the deployment also holds a write-capable warehouse key.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Verify publisher and deployment provenance, inspect egress and granted downstream access, and require review when server code or operator changes.
03 / Failure and evidence
What goes wrong, and what can be proven?
A familiar tool name masks a provider with broad credentials or an unreviewed update.
Keep approved server identity, version, operator, permissions and review decision.
04 / Canonical scope
Why this reference stands alone
Client security covers the connecting client; this page evaluates the server as a supply-chain and execution dependency.
Protocol or attack trace
Server review delta
Approved server version V1 has warehouse read access; V2 adds outbound egress and a write-capable key.
Deploy V2 without renewed approval; admission should pause or constrain the added privileges.
Primary references