Designing Zero-Trust Multi-Agent Workflows with Model Context Protocol (MCP)

The Necessity of Zero-Trust in Agentic Systems§

As large language model agents transition from passive chat widgets to active system orchestrators, security paradigms must evolve. In traditional web applications, permissions are strictly authenticated based on user session tokens. However, in autonomous multi-agent systems, primary agents routinely delegate tasks to specialized sub-agents. Without granular zero-trust boundaries, a rogue or hallucinating sub-agent could invoke high-privilege commands, access restricted databases, or mutate file structures.

The Model Context Protocol (MCP), introduced as an open standard for connecting AI models to external data sources and tools, provides the foundation for standardizing tool definitions. However, standardizing transport (JSON-RPC over STDIO or HTTP with SSE) is only half the battle; securing the execution boundary requires a Zero-Trust Multi-Agent Architecture.

---

Core Security Architecture: Token Propagation and Scoping§

In a zero-trust MCP environment, no agent is trusted by default regardless of whether it operates inside the local network. Every tool call dispatched to an MCP server must carry a cryptographically signed invocation token specifying: 1. Agent Identifier & Lineage: Tracing the root prompt and delegating parent agent IDs. 2. Explicit Scope Grants: A list of permitted tool names (e.g., fs.read_file, sql.select_only). 3. Execution Expiry Window: Short-lived TTLs (e.g., 60 seconds) to mitigate token replay attacks.

interface MCPInvocationToken {
  iss: "llmdb-orchestrator";
  sub: "subagent-code-auditor-849";
  aud: "mcp-server-filesystem";
  exp: number; // Unix timestamp
  scopes: Array<"read_file" | "list_directory">; // Write scopes excluded
  session_hash: string;
}

---

Step-by-Step Implementation: Scoped MCP Middleware§

Below is an implementation of a zero-trust middleware wrapper for an Express-based HTTP/SSE MCP server in TypeScript. The middleware intercepts incoming JSON-RPC tool requests, verifies the JWT payload, and asserts that requested tool invocation aligns strictly with allowed scope bounds.

import { Request, Response, NextFunction } from "express";
import jwt from "jsonwebtoken";

export function createZeroTrustMCPAuth(jwtPublicKey: string) {
  return (req: Request, res: Response, next: NextFunction) => {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith("Bearer ")) {
      return res.status(401).json({
        jsonrpc: "2.0",
        error: { code: -32001, message: "Missing or malformed Authorization header" },
        id: req.body?.id || null,
      });
    }

    const token = authHeader.split(" ")[1];
    try {
      const decoded = jwt.verify(token, jwtPublicKey, { algorithms: ["RS256"] }) as MCPInvocationToken;
      
      const requestedTool = req.body?.params?.name;
      if (requestedTool && !decoded.scopes.includes(requestedTool)) {
        return res.status(403).json({
          jsonrpc: "2.0",
          error: {
            code: -32002,
            message: `Permission Denied: Agent ${decoded.sub} lacks scope "${requestedTool}"`,
          },
          id: req.body.id,
        });
      }

      req.agentToken = decoded;
      next();
    } catch (err) {
      return res.status(401).json({
        jsonrpc: "2.0",
        error: { code: -32001, message: "Invalid or expired MCP token" },
        id: req.body?.id || null,
      });
    }
  };
}

---

Sandboxing MCP Tool Runtimes§

Authentication at the API boundary is insufficient if tool execution occurs directly on host infrastructure. To isolate host operating systems:

• Ephemeral WebAssembly Containers: Execute code-editing tools inside Wasm runtimes (e.g., Wasmer/Extism) with isolated memory limits.
• Docker Read-Only Volume Binds: When file operations are required, mount target paths in read-only mode unless explicit write permissions are signed in the session token.
• Egress Network Controls: Restrict MCP servers from initiating outbound HTTP calls except to explicit allowlisted domain endpoints.

---

Conclusion & Architectural Recommendations§

Zero-trust multi-agent systems prevent catastrophic cascading failures in automated pipelines. By combining Model Context Protocol (MCP) standardized schemas with cryptographically verified JWT tokens and sandboxed container isolation, enterprise teams can safely deploy autonomous AI agents to automate complex operations.