Skip to Content
MCP Security Review Checklist
MCP Security Review Checklist

A practical checklist for reviewing an MCP server before connecting email, databases, files, shell, cloud infrastructure, or remote tools.

MCP Security Review Checklist

Use this page before you install or approve an MCP server. The goal is not to block MCP adoption. The goal is to make the first connection small, observable, and reversible.

If you only have two minutes, start with the MCP Risk Calculator, copy the assessment, and then use this checklist for the review notes.

1. Source identity

CheckPass conditionFail signal
Canonical sourceOfficial registry, official docs, or a repo owned by the expected publisherRandom package with no clear owner
Package identityPackage name, repo, docs, and install command refer to the same projectSimilar-looking package names or mismatched repository links
Maintainer trailRecent commits or releases, issue responses, and readable docsAbandoned repo, empty docs, or sudden publisher changes
Install pathInstall command is understandable and pinned when possibleCurl-to-shell, hidden postinstall behavior, or unclear binaries

Do not treat stars, directory listings, or social mentions as proof of safety. They are discovery signals, not permission evidence.

2. Permission and capability boundary

Classify what the server can do before thinking about whether the workflow is useful.

CapabilityFirst-test postureExtra review required when
Read recordsOne test account, folder, database, or projectIt can access full inboxes, customer data, source code, or regulated records
Write recordsDisabled until read-only tests passIt can send email, create tickets, update rows, or modify calendar events
Delete or destructive actionsHuman approval outside the MCP callIt can delete files, records, pods, deployments, buckets, or user data
FilesystemSingle scratch folderIt can read home directories, source repos, secrets, dotfiles, or downloads
Shell or command executionTiny allowlist such as pwd, ls, catIt can run package managers, network commands, scripts, or credential tools
Network accessDomain allowlist and request loggingIt can send arbitrary outbound requests
Cloud or KubernetesStaging context, read-only roleIt touches production resources or write-capable credentials

3. Auth and secret handling

Auth modeSafer defaultWatch for
No authLocal-only test dataRemote server with no user-level boundary
API keyDedicated low-scope tokenReused personal, admin, or production token
OAuthNarrow read-only scopesBroad workspace scopes, refresh tokens, or unclear token storage
Cloud IAMDedicated role and staging projectOwner, admin, wildcard, or production write permissions

Secrets should stay out of docs, repos, screenshots, issue comments, and copied configs. A useful MCP guide must name which variables are sensitive.

4. Runtime and data path

Ask where the tool runs and where data can move.

RuntimeReview questions
Local stdioWhich binary runs? Which files can it read? Can it execute subprocesses? Does it make network calls?
Remote HTTP/SSEWho operates the endpoint? What data leaves the machine? Is auth user-scoped? Are logs retained?
DockerWhich volumes are mounted? Is the network open? Are credentials passed as env vars or files?
Cloud-hostedWhich tenant owns the infra? Can the operator inspect prompts, tool args, or outputs?

Remote MCP can be useful, but the trust model is different. A remote server is not just an install command. It is a service you are sending tool context to.

5. First tool-call test

The first call should prove the connection works without exposing sensitive data or changing state.

Good first prompts:

List available tools and describe the lowest-risk read-only check.
Show only metadata for the test dataset. Do not retrieve row contents.
List namespaces and pod names in the staging context. Do not change anything.

Avoid first prompts that ask for broad summaries, searches across private data, writes, deletes, or production troubleshooting.

6. Review note template

Copy this into a PR, issue, or internal review:

MCP server:
Source:
Install command:
Runtime: local stdio / remote HTTP / SSE / Docker / hosted
Auth mode:
Sensitive env vars or files:
Requested capabilities:
Data touched:
First-test scope:
Write/delete/exec enabled: yes/no
Rollback:
Risk tier:
Reviewer decision:

7. Decision rule

Approve the first test only when all three are true:

  1. The server source is clear enough to explain to another developer.
  2. The credential scope is smaller than the real account or production system.
  3. The first tool call is read-only, observable, and reversible.

If any of those fail, do not argue about SEO, popularity, or convenience. Shrink the test.

Freshness: reviewed on May 17, 2026.

Last updated on