Confused deputy

Confused deputy: An attack where a proxy with its own credentials is tricked into acting for someone else; MCP security guidance addresses it for OAuth proxies. Example: Vercel MCP requires explicit consent for each client connection to prevent it. Next in the glossary is document.modelContext: The WebMCP entry point on the document object that holds registerTool, getTools and executeTool.

Definition

An attack where a proxy with its own credentials is tricked into acting for someone else; MCP security guidance addresses it for OAuth proxies.

Example, with source

Vercel MCP requires explicit consent for each client connection to prevent it. (vercel.com, read 4 November 2026)

Where it appears on this site

• MCP
• OAuth for MCP
• Building a remote MCP server

Neighbouring terms

• Code Mode: A Cloudflare approach where the agent writes code against a typed API instead of calling many tools one by one, set by portal policy.
• document.modelContext: The WebMCP entry point on the document object that holds registerTool, getTools and executeTool.
• Dynamic Client Registration (DCR): RFC 7591 registration where a client POSTs to /register for credentials; deprecated in MCP 2026-07-28 and kept for compatibility.