hi everyone 👋

i've been trying to learn about MCP security by building things. i wanted to see if i could make an MCP server that *requires* TLS client certificates to connect. i think it helps with the "who is this?" (authentication) part.

i got a basic proof-of-concept working! it's a simple python server using FastMCP. the server checks for a valid client cert signed by my own CA before it even listens for any MCP messages. if the cert isn't there or is bad, the connection is dropped immediately.

this seems like it could be useful for self-hosted agents where you want to be really sure about the client. but i'm still learning... does this actually stop all the potential abuse cases? or are there other ways a tool or resource server could be messed with? i'd love an ELI5 on what else i might be missing.

thanks for any insights!