The most common MCP vulnerability is the "omnibus tool," and the fix is structural, not a patch.

Per the MCP Server Security Best Practices 2026 guide, a single tool like execute, query, or run that takes free-form input and dispatches on a runtime action string becomes a privilege-escalation primitive. You match handlers against a fixed enum of operations, and you make dangerous requests literally unexpressible: enums over strings, bounded integers, branded IDs in the schema. Add per-tool authorization at dispatch (never let a handler check its own permissions), and read tenant IDs from verified token claims, not the request body. This is the rare security finding where the secure version is also the cleaner design.