FACT COPY · EN
Fact copy: Understanding MCP architecture and security
Vendor-neutral background, architecture patterns and evaluation criteria for understanding mcp architecture and security.
Canonical source: https://travel-mcp.com/en/knowledge/practical/architecture-security/
Factual summary
This knowledge page explains understanding mcp architecture and security as an engineering and governance problem. It distinguishes protocol behaviour, travel-domain rules, system ownership and evidence required for production use.
Trust boundaries and authorization path
A complete architecture distinguishes host, MCP client, MCP server, authorization server, gateway and downstream travel system. Authentication at the MCP endpoint is only one control: object-level authorization, tenant isolation and business rules must still be enforced at the system of record.
Threat modelling must cover prompt injection, tool poisoning, confused-deputy flows, token theft, SSRF, session hijacking and excessive result disclosure. Controls are mapped to the boundary that can enforce them, rather than delegated to the language model.
Transactional safeguards
Search, quotation, hold, booking, ticketing, payment, exchange and cancellation are different risk classes. Binding operations require fresh state validation, an explicit presentation of price and conditions, idempotency and a durable audit record.
A production design also needs per-tool kill switches, negative authorization tests, recovery procedures and correlation identifiers spanning the host, MCP server and downstream supplier.