MCP servers and their boundaries

A connected server's boundaries are specified, not enforced. The Model Context Protocol says so in its own words: it "cannot enforce these security principles at the protocol level", and leaves consent flows, authorization and access control to implementors¹. Its architecture does define a real isolation rule, that a server should not be able to read the whole conversation or see into other servers, with the full history staying in the host and the host enforcing the boundaries². Capabilities are negotiated explicitly at initialization and both sides must respect what was declared for that session².

Which obligations are binding is worth reading carefully, because the strong requirements and the party that carries them do not line up with intuition.

The untrusted-annotation rule is the one to internalise. Descriptions of tool behaviour, annotations included, are to be treated as untrusted unless they come from a server you trust¹, and clients must do the same³. Tools are model-controlled by design, and the specification asks for a human able to deny an invocation while mandating no particular interaction model³. Local servers are ordinary binaries on your machine running with the client's privileges, which is why a one-click install must show the exact command in full and require approval⁴.

The boundary is the non-interactive case and the unmeasured remainder. In Claude Code, project-scoped servers from untrusted workspaces prompt for approval in an interactive session but load without prompting under a print or SDK run⁵, so a review you rely on may simply not happen in automation. Two things this volume could not source: there is no figure for how often tool-description injection is actually observed in the wild, and no documented account of the context cost of a connected server's tool definitions, so the claim that servers crowd the tool list is left unasserted here. Cross-tool comparison is also out of reach, since no equivalent gating documentation was available for Cursor or Copilot.