What is the confused deputy problem in MCP?
In short: A confused deputy is a trusted proxy tricked into using its own privileges for someone else. The MCP security best practices describe it for proxy servers that use a static client ID with a third-party API. A gateway mitigates it by requiring consent per client and checking each call against the real caller.
What happens?
An MCP proxy uses one static client ID for a third-party API.
An attacker reuses a consent cookie from an earlier user, so the proxy obtains a code for the attacker.
How does a gateway mitigate it?
- Obtain user consent for each dynamically registered client before forwarding.
- Bind each call to the agent and the person it acts for, so the gateway never acts on its own authority.
Which scored gateways document a mitigation?
| Gateway | Documented control | Source |
|---|---|---|
| NewCore | Identifies the agent and the person behind it on every call. | [nc-secure] |
| Silverfort | Sessions correlated to a person through the identity provider. | [sf-ai] |
| Idira | Agent and user identity captured per call in full mode. | [id-docs] |
Facts only. A gateway missing here may still mitigate the threat; we list what its public pages document.
Sources
- MCP spec: Security best practices [mcp-sec] read 2026-11-03
- NewCore: Secure [nc-secure] read 2026-11-03
- Silverfort AI agent security [sf-ai] read 2026-11-03
- CyberArk Secure AI architecture [id-docs] read 2026-11-03
All eight threats are listed on the threats hub.
By The Datasheet desk · Published and reviewed 2026-11-03