MCP Advanced Topics · lesson 2 of 4

MCP Trust Model & Configuration

MCP servers run with full permissions of the host — they can read your files, hit your APIs, send messages. Trust matters.

The trust gradient

First-party servers (you wrote them, you run them) — full trust.
Vendor servers from known parties (Linear, Slack official) — high trust, scoped to that service.
Community servers — review code before installing; treat like running arbitrary software.
Untrusted / generated — sandbox or don't run.

Confirmation flows

For destructive or sensitive tools, the host should ask the user before each call. Patterns:

Always confirm — for first-time tool calls of a destructive tool.
Allow this session — user trusts within session.
Always allow — durable consent (per tool + per server).

In Claude Code, this is governed by .claude/settings.json permission rules.

Configuration scopes (Claude Code)

Claude Code reads MCP server config from multiple locations, in order:

Project local — .mcp.json in the project root.
Project shared — .claude/mcp.json (committed to repo).
User — ~/.claude/mcp.json (global to you).
Enterprise — managed deployment.

Lower scope wins. Use project local for experiments, user for tools you use everywhere.

Common config shape

{
  "mcpServers": {
    "linear": {
      "command": "npx",
      "args": ["-y", "@linear/mcp-server"],
      "env": {"LINEAR_API_KEY": "${env:LINEAR_API_KEY}"}
    },
    "company-internal": {
      "url": "https://mcp.company.internal/v1",
      "type": "http"
    }
  }
}

Security do's & don'ts

DO review tool descriptions before installing — descriptions are LLM-facing and could include prompt injections.
DO prefer scoped credentials (read-only DB user, narrow OAuth scope).
DO treat the file-system server's "allowed paths" config as critical.
DON'T put plaintext secrets in config — use env var substitution.
DON'T install community servers in privileged environments (production, prod cred stores).

CCA-F note

The "trust model" question types: which scope to put a config in, when to require confirmation, how to prevent a malicious server from exfiltrating data. Answer pattern: least privilege + explicit consent for destructive ops + reviewed code.