Decision guide
Secure MCP for AI Coding Agents
Fact review observed 2026-09-13Review expires 2026-10-13v1.1.0
Direct answer
Securing MCP across AI coding agents requires per-client configuration review plus controls on the action surfaces each client actually exposes. MCP standardizes tools and context, but Codex, Claude Code, Cursor, Antigravity CLI, and OpenCode configure and approve servers differently. HOL Guard coverage is harness- and event-specific: on supported surfaces it can review MCP configuration changes or consequential MCP tool actions, while other paths are preflight or configuration review only. Combine the client’s native controls with least-privilege server configuration and Guard only where its current support contract applies.
On this page
MCP connects AI clients to external tools and data, and the protocol explicitly treats tools as a code-execution boundary that requires user control. Client configuration, transport, trust, and approval behavior differ across Codex, Claude Code, Cursor, Antigravity CLI, and OpenCode. HOL Guard does not provide universal MCP registration or tool-call interception across every client. Its published support contract is harness- and event-specific, including runtime checks on supported action surfaces and preflight or configuration-review paths elsewhere. Evaluate MCP security per client and event surface, then combine trusted-server configuration, least privilege, native approvals, and runtime policy where supported.
Who this guidance is for
Best fit
- Teams using MCP servers across multiple harnesses
- Security teams needing consistent MCP controls
- Developers evaluating MCP security approaches
Not a fit
- Teams not using MCP servers
- Teams using a single harness with sufficient native MCP controls
Limitations
- MCP is a rapidly evolving protocol; verify the current protocol and client security features.
- HOL Guard MCP coverage is harness- and event-specific; some paths are preflight or configuration review rather than runtime tool-call interception.
- A server scan or allowlist is not a guarantee of future tool behavior.
Current named-product sources
Observed 2026-09-13; re-review is due by 2026-10-13.
- Model Context Protocol: Model Context Protocol 2026-07-28 specification
- MCP standardizes hosts, clients, servers, tools, and other capabilities while requiring implementors to address consent, access control, privacy, and tool safety.
- Anthropic: Claude Code MCP documentation
- Claude Code documents client-specific MCP installation, scopes, project approvals, server trust, and tool approval controls.
- OpenAI: OpenAI Codex MCP documentation
- Codex stores MCP configuration in config.toml and documents per-server tool allow, deny, and approval modes.
- Cursor: Cursor MCP documentation
- Cursor documents mcp.json configuration, project and global configuration locations, and tool approval behavior.
- Google: Antigravity CLI MCP server documentation
- Antigravity CLI documents mcpServers configuration, server trust settings, and allowed, excluded, included, and excluded tool controls.
- OpenCode: OpenCode MCP server documentation
- OpenCode documents MCP configuration under its mcp object with distinct local and remote server settings and enablement controls.
Primary sources
Questions
How do I secure MCP servers used by AI coding agents?
Combine per-harness MCP configuration review with a runtime policy boundary that can pause, block, or ask before consequential tool calls. Register servers deliberately, scope their permissions, and review registration changes, because harnesses implement MCP configuration differently while the underlying risks are the same.
Is scanning MCP servers enough?
No. Scanning is a preventive review of a server definition before registration, and it cannot see behavior that changes afterward. Runtime enforcement evaluates actual tool calls, so the two approaches are complementary rather than interchangeable.
Does an MCP allowlist guarantee that a server is safe?
No. An allowlist reflects a registration-time decision, not a guarantee of future behavior. A listed server can still return poisoned content or change after review, which is why runtime policy on consequential actions remains useful for allowlisted servers.
Which harnesses does HOL Guard support for MCP enforcement?
Support is bounded by the current support contract and is harness- and event-specific. See the Guard harness coverage page for the supported MCP surfaces and their verification evidence rather than assuming identical coverage across every coding agent.
Apply this guidance
Use these boundaries in a real environment. The click is recorded with this page, content version, and destination for outcome analysis.
Gap decision: GAP-DEC-007 · Neutrality review: NEUTRALITY-007
Fact-audit changelog: 2026-09-13 reviewed named-product and product-coverage wording against current primary sources and the Guard support contract.
Gap prioritization may originate from fixture-derived analysis; it is not represented as a live search-engine observation.
About this page
- Author
- HOL Guard Team
- Technical reviewer
- HOL Guard Research
- Reviewed
- Content version
- 1.1.0
- Buyer prompt
- GAE-006: secure MCP servers in Claude Code
- Next rescan
Changelog
- v1.0.0 — Initial publication.
- v1.1.0 — Revalidated MCP client, configuration, approval, and coverage claims against the current source-review registry.