An MCP server is being designed to expose a company's internal SQL database to Claude-powered agents. The server implements a run_query tool that accepts arbitrary SQL strings. During a security review, a red-teamer demonstrates that an agent can be prompted to run DROP TABLE via this tool. What MCP server-side control is the most appropriate architectural response?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because the root vulnerability is the free-form SQL interface, which provides no structural constraint on what operations an agent can perform. Replacing it with narrowly scoped tools that call parameterized queries eliminates SQL injection and privilege escalation at the architectural level — the agent can never formulate a DROP TABLE because no tool accepts arbitrary SQL.
Full explanation below image
Full Explanation
C is correct because the root vulnerability is the free-form SQL interface, which provides no structural constraint on what operations an agent can perform. Replacing it with narrowly scoped tools that call parameterized queries eliminates SQL injection and privilege escalation at the architectural level — the agent can never formulate a DROP TABLE because no tool accepts arbitrary SQL. A is wrong because keyword blocklists are easily bypassed through comment injection, Unicode normalization, or obfuscated DDL; they add friction but do not close the vulnerability. B is wrong because the system prompt instruction is a model-layer control, not a server-layer control; an adversarially prompted agent, a model update, or a jailbreak could bypass it. Architectural controls must not rely solely on model behavior. D is wrong because logging and alerting is a detective control, not a preventive one; it detects the attack after damage has already been done.