Your agent will connect to several MCP servers, some built by third parties. How do you make this secure?

What the interviewer wants to hear

• Treat servers, tool descriptions and tool results as untrusted input
• Apply least privilege with scoped credentials per server
• Require human approval for sensitive or irreversible actions
• Avoid combining private data, untrusted content and exfiltration paths
• Pin and review server versions, sandbox them, and log all tool calls

Model answer

I treat every MCP server as untrusted code and its output as untrusted input. Tool descriptions and results go straight into the model context, so a malicious server can inject instructions. I review descriptions before enabling a server, pin versions so they cannot change silently, and run local servers in a sandbox with limited file and network access. Each server gets its own scoped credentials with least privilege, and OAuth tokens are never passed between servers. I watch for the dangerous mix of private data, untrusted content and a way to send data out, because together they allow exfiltration; I remove one leg or require human approval for actions like sending email, payments or deleting data. Finally I log every tool call with its arguments for audit, and red-team the setup with injected content.

More hard AI Engineer (LLM & Generative AI) questions

• Design a RAG assistant over 2 million internal documents with different access permissions per team.
• How would you protect an LLM application that reads emails and can take actions, against prompt injection and data leaks?
• An agent that completes multi-step tasks works in demos but fails often in production. How do you make it reliable?
• Your LLM feature costs too much and p95 latency is 9 seconds. Walk through how you would reduce both without hurting quality.
• When would you fine-tune a smaller open-weight model instead of using a large hosted model, and how would you do it?
• You must self-host an open-weights LLM for a high-traffic product. How do you plan memory, throughput and latency?
• Users say your AI assistant got worse this week, but nothing obvious changed. How do you investigate?
• How do you design an LLM-as-judge evaluation you can actually trust?
• When would you choose a multi-agent architecture over a single agent or a fixed workflow?