MCP runtime guard
Pre-Adoption Inspection and Review After Updates
You can review an MCP server’s provenance, permissions, and external connections before adoption. After a server or dependency is updated, its tools, destinations, and execution behavior can change, so it needs another inspection and another confirmation of the required restrictions.
The role of pre-adoption inspection
The public Registry and inspection evidence help review the publisher, implementation, permissions, authentication method, and external connections before connecting. They do not guarantee updates after the inspection time or a user’s local environment.
- Publisher and implementation
- Requested permissions
- Credentials
- External connections
- Inspection date
What to review after an update
For an already adopted server, review its inspection result and allowed scope whenever its tool list, required permissions, dependencies, or external destinations change.
- Tool list
- File access
- Command execution
- External communication
- Dependencies
Restrictions to confirm before connecting
For RESTRICT, enforce the required restrictions at the specified MCP client, OS or container, gateway, or provider service, and confirm them before connecting. Do not connect when they cannot be verified.
- MCP client configuration
- OS and container restrictions
- Gateway and provider-service restrictions
- Confirmation before connecting
What Abcas MCP Guard can do
Full inspection procedure catalog
25
Baseline procedures for local MCP
22
Baseline procedures for public HTTPS
13
Applicable procedures and evidence that can be obtained vary by target. The counts for operation, dependency review, and consistency review categories (18 / 4 / 17) help organize the observations.
MCP vulnerabilities and checks before connecting →