• This cookbook is built around a single server and you can use it to harden things recipe by recipe. It works through more than fifty real vulnerabilities drawn from a scan of over eleven thousand production servers. You'll be closing code-execution sinks, pinning a runaway dependency supply chain, catching tools that mutate after approval, and enforcing authentication that servers only pretend to require. It'll be your job to defend the agent's own context against prompt injection and tool poisoning, lock down OAuth flows, protect consent screens, isolate untrusting servers on a shared host, and set the operational defaults that decide how far any single flaw can travel.

• Every recipe describes the problem, shows the working code to solve it, and proves that the solution works. If you build, run, or secure MCP servers on Linux, this book will help you turn your experience into everyday, repeatable practice.

Key Learnings

• Treat every tool argument as attacker-controlled, and replace risky primitives with narrow, safe alternatives.
• Pin, hash, and audit the entire dependency tree so nothing changes without review.
• Catch rug pulls by hashing approved tool definitions and re-verifying them every session.
• Enforce authentication and per-tool authorization in code, never merely declare it in a manifest.
• Defend the agent context by stopping tool content from ever triggering actions.
• Validate token audience and issuer so a credential works only where intended.
• Secure OAuth flows with PKCE, bound state parameters, and per-client consent.
• Protect human consent against clickjacking and fatigue with framing rules and rare prompts.
• Isolate untrusting servers on a shared host by namespacing tools and scoping context.
• Contain blast radius through sandboxing, least privilege, audit logging, and rate limiting.