A user adds a new MCP server to a host. Before the user has approved anything, the host is about to send that server the contents of a local file the user opened earlier. What do the specification's security principles require?
Select an answer to reveal the explanation.
Short Explanation
Adding a server is like hiring a contractor; it doesn't mean they get the keys to your filing cabinet. The host has to ask you before your data leaves the building. And it's the host that asks, not the contractor after they've already got the file.
Full Explanation
The specification's key principles start with user consent and control: users must explicitly consent to and understand all data access and operations, and must retain control over what data is shared and what actions are taken. Under data privacy, hosts must obtain explicit user consent before exposing user data to servers, must not transmit resource data elsewhere without user consent, and should protect user data with appropriate access controls. The architecture assigns enforcement to the host, which handles consent and user authorization decisions. A file the user opened is user data, so the host must ask before sending it to the newly added server. Treating installation as blanket consent fails by concept: consent must be explicit and understood for the specific data access, and installing a server does not tell the user what data it will receive. Moving consent to the server after delivery fails because the server is the party receiving the data; by then the exposure has happened, and the host is the component responsible for consent. Tying it to the roots capability fails because roots are a deprecated client feature that informs servers which locations matter, not a consent or access mechanism. Exam caveat: the specification says MCP cannot enforce these principles itself, so implementors must build consent flows. Operational check: add a fresh server and confirm the host prompts before any file content is sent.