GenAI Cracow 32: Security in MCP Servers

Agenda

Opening Ceremony

Adding Auth0 Sign-In and Token Exchange to a MCP Server by Michal

When the MCP Server Is the Attacker by Bartłomiej

Networking

Abstract

Adding Auth0 Sign-In and Token Exchange to a MCP ServerMy Auth0 Management API MCP server started with a hardcoded token that let any agent using it delete users in my tenant. Replacing it meant implementing the authorization part of the MCP spec: discovery metadata so clients find the authorization server, client registration, and OAuth 2.1 sign-in through Auth0. The server then uses On-Behalf-Of Token Exchange to swap the client’s token for a short-lived one scoped to the downstream API, so an agent can only do what the signed-in user can. Live demo in MCP Inspector.

When the MCP Server Is the AttackerThe previous talk makes sure an agent can only do what the signed-in user can. This one asks the opposite question: what if the MCP server your agent connects to is the attacker? We shipped custom MCP connectors in a production AI agent, so our cluster fetches URLs an attacker chooses and our model reads tool descriptions an attacker writes. The discovery metadata and client registration from the previous talk become the attack surface. In live demos against a deliberately naive client, we’ll steal an OAuth token with a single redirect, reach an internal endpoint with DNS rebinding, and hijack the model with a poisoned tool description. Then we’ll fix each one, and see why validation alone isn’t enough: what held up in production was architecture, from an egress proxy to keeping customer tools out of unattended runs. You’ll leave with a checklist for building MCP clients.

Speakers

Michał Klepacki, Solutions Engineer @ Okta

Bartłomiej CzechSoftware Engineer @ ActiveCampaign, working on integrations. He is interested in how systems behave in production and how engineering decisions translate into real user interactions. Outside of work, he studies cybersecurity, with a focus on securing AI systems.LinkedIn

Partners

ActiveCampaignMarketing industry has spent decades asking humans to think like machines - configure this trigger, map that workflow, repeat. At ActiveCampaign we are building the opposite: a platform where AI handles the orchestration, and our customers can focus on outcomes. Active Intelligence, our production AI layer, is what makes that real - autonomous campaign execution across email, SMS, and CRM, at the scale of tens of thousands of businesses. Our Cracow Hub is where nine engineering teams turn that ambition into working software - and where agentic workflows, RAG, MCP, and AI-assisted development are not tools we experiment with, but the way we build.

CEE AI Hub