Title: Quiz 11 — MCP Authentication and Tool/Agent Security
Course: AIINFRA 300: Agentic AI & the Model Context Protocol (MCP) > Section: Week 11 — MCP Authentication and Tool/Agent Security

Q: What was the primary purpose of the June 2025 change that reclassified MCP servers as OAuth 2.1 resource servers?
- To make servers faster
- To prohibit servers from passing through client access tokens to upstream APIs, preventing confused-deputy attacks
- To eliminate the need for authorization entirely
- To require servers to store user passwords
A: To prohibit servers from passing through client access tokens to upstream APIs, preventing confused-deputy attacks

Q: As of November 2025, PKCE (Proof Key for Code Exchange) is optional for MCP client-side applications, recommended but not required.
- True
- False
A: False

Q: What is the purpose of OAuth 2.0 Protected Resource Metadata (RFC 9728) in the MCP authorization model?
- It encrypts all tool call payloads
- It allows an MCP server to publish which authorization server(s) issue valid tokens for it, enabling discovery
- It replaces the need for access tokens
- It defines the JSON schema format for tools/list
A: It allows an MCP server to publish which authorization server(s) issue valid tokens for it, enabling discovery

Q: What is a "Resource Indicator" (as in RFC 8707), and what problem does including a resource parameter in authorization/token requests solve?
Feedback: Sample/expected answer: A Resource Indicator is a parameter that names the specific intended server (audience) for a token in the authorization and token requests. It binds the issued token to that specific MCP server, preventing a token obtained for one server from being replayed against a different server.

Q: In a tool poisoning attack, where are the malicious instructions typically hidden?
- Only in the user's typed prompt
- In the tool's description, parameter schema, or return values returned by tools/list or tool calls
- In the network's TLS certificate
- In the client's local operating system settings
A: In the tool's description, parameter schema, or return values returned by tools/list or tool calls

Q: Sandboxing or containerizing an MCP server eliminates the risk of prompt injection and confused-deputy attacks.
- True
- False
A: False

Q: According to recent security audits referenced this week, approximately what percentage of audited MCP servers still require no authentication at all?
- 5%
- 15%
- 40%
- 90%
A: 40%

Q: Name two concrete defenses (beyond simply "having authentication") that this week's lecture and lab recommend for mitigating tool poisoning attacks.
Feedback: Sample/expected answer: Any two of: input allow-listing/validation on tool descriptions and metadata; treating tool descriptions and return values as untrusted data rather than trusted context; requiring human confirmation before executing sensitive/irreversible tool actions.