MCP Server Security Checklist

Why MCP servers need a security review

When you connect an MCP server, you are trusting its code, its operators, its dependencies, and everything it will ever return to your model. Tool descriptions are read by the model to decide what to call, and tool results are fed back into its context. Both are attacker-controllable if the server is malicious or compromised. This checklist gives you a fast, repeatable way to judge whether a server is safe enough to connect.

What it covers

The scorecard groups controls into five areas:

• Source and trust: is the server from a known publisher, is the repository reputable, and have you checked for typosquatted or lookalike names.
• Permissions and scope: does the server request only the tools and access it actually needs, and are destructive actions gated behind human approval.
• Secrets and auth: are credentials kept out of plaintext config, and is OAuth scoped narrowly to avoid the confused-deputy problem.
• Runtime and network: is the server pinned to a verified version so it cannot silently change behavior in a rug pull, and is its network egress limited.
• Monitoring and governance: are tool calls logged, and is there an allowlist of approved servers.

How to use it

Work through each item and check the ones your server satisfies. The tool computes a live risk score and a verdict band. Any unmet critical control forces a high-risk rating. When you are done, copy the report and attach it to a change ticket or review.

Honest framing

MCP is not uniquely unsafe, but it widens the attack surface of an AI system. This checklist is a starting point for due diligence, not a guarantee. Re-review a server whenever it updates.

Related

For the full background, read our breakdown of MCP security risks and how to mitigate them.