Model Context Protocol can connect AI applications to enterprise tools and data through a consistent interface. That convenience concentrates risk: a server may expose powerful actions, credentials and sensitive resources to a probabilistic agent consuming untrusted content. Security must cover the client, host, server, authorization service, upstream APIs, tools and data. Protocol compliance is necessary but does not replace application and operational controls.

Executive perspective

The decision behind MCP server security checklist is an operating-model choice, not a demonstration. Leaders need to define the business result, evidence, control boundary, cost and accountable owner before selecting detailed technology. Production success requires a transition path that remains safe when data is incomplete, dependencies fail or user behaviour differs from assumptions.

State the baseline, risk appetite and acceptance thresholds. Separate authoritative facts from assumptions and practitioner signals. Use bounded experiments to answer consequential uncertainties, and stop or redesign when evidence does not support the expected quality, security or economics.

Inventory every MCP trust boundary

Record hosts, clients, servers, transports, authorization services, upstream APIs, tools, resources, prompts, users and network paths. Classify data and actions. Identify whether a server is local, remote, third-party or multi-tenant. Unknown servers and shadow configurations are immediate risk.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Use supported authorization correctly

For HTTP transports, follow the MCP authorization specification and OAuth 2.1 controls. Use protected-resource metadata, resource indicators and audience validation. Require PKCE for public clients. Authorization must be included and validated on every request.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Prohibit token passthrough

An MCP server must not accept a token intended for another resource and forward it upstream. Obtain a separate upstream token and bind tokens to the intended audience. Passthrough creates confused-deputy and credential-theft risk.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Apply least privilege to tools and resources

Define narrow scopes by user, server, tool, action and data. Separate read, draft and execute. Prefer task-specific tools over generic shell, browser or database access. Use short-lived credentials and restrict environment, tenant and destination.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Treat tool descriptions and results as untrusted

A malicious server can misdescribe a tool, and a legitimate tool can return injected content. Pin approved servers, verify provenance and separate observations from policy. Do not let tool output grant permission or alter system instructions.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Require meaningful consent for consequential actions

Show the exact tool, target, payload and side effects at approval. Avoid blanket consent for broad future actions. Require re-authentication or dual control for high-impact operations. The host must enforce approval, not trust the model to request it.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Validate every tool argument and output

Use strict schemas, allowlists, length and type checks, server-side authorisation and business validation. Prevent path traversal, injection, SSRF and unsafe file handling. Treat model-generated parameters like hostile user input.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Isolate server execution

Run servers with restricted filesystem, network, process and secret access. Separate tenants and environments. Use ephemeral workers where practical. Limit outbound destinations and block metadata services. Do not run untrusted local servers with a user’s full desktop privileges.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Protect credentials and secrets

Keep secrets out of prompts, logs and tool results. Use secure brokers or workload identities, rotate keys and revoke on termination. Restrict refresh tokens and encrypt storage. Scan configuration and repositories for accidental credentials.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Secure discovery, installation and updates

Maintain an approved registry, verify publishers and artefacts, pin versions and review changes. Scan dependencies and software bills of materials. Treat a new server or tool definition as a privileged integration requiring review.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Log the complete action path

Record user, host, server, tool, parameters with sensitive redaction, policy decision, approval, upstream identity, result and final outcome. Alert on unusual servers, scopes, destinations, tool sequences, failures and data volume. Protect logs from tampering.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Test adversarial and failure scenarios

Test prompt injection, malicious tool descriptions, audience confusion, token theft, cross-tenant access, replay, SSRF, destructive action, poisoned updates and server compromise. Exercise revocation and kill switches. Re-run after specification, client, server or model changes.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Prepare incident response and governance

Assign owners for inventory, approval, security review, server operation and business outcome. Create playbooks to disable a server, revoke tokens, isolate hosts and investigate actions. Review exceptions and third parties. Retire unused integrations promptly.

Convert this principle into a concrete specification, control, test, runbook or service-level objective. Give it one accountable owner and reviewers from the functions exposed to the outcome. Document the exception path, escalation and retained evidence so teams can operate the design under pressure.

Compare alternatives on outcome, delivery effort, recurring cost, latency, reliability, security, reversibility and cost of delay. A representative pilot should include failure and abuse cases and finish with an explicit go, change or stop decision. A showcase without thresholds does not reduce production risk.

Implementation scorecard

Track user or business outcome, adoption, accuracy, reliability, security exceptions, change lead time, unit cost and realised benefit. Give every metric a baseline, target, source, review cadence and owner. Segment results by tenant, workflow, risk tier or market so aggregate performance cannot hide concentrated failures.

Recommended engagement approach

Start with one representative workflow and produce the architecture, data and permission map, risk register, economic model, evaluation plan and staged roadmap. Project Supply can connect digital engineering, AI/data, ecommerce and cybersecurity delivery to move MCP server security checklist from assessment into controlled production.