MCP server security checklist
A Checklist for Using MCP Servers Safely
Before connecting an MCP server to Claude or another AI agent, use the Registry to confirm which permissions it receives, where it connects, and which data it handles.
1. Confirm the publisher and provenance
Check whether the distribution is official or from a trusted developer, whether it has an update history, and whether there are sudden ownership or dependency changes.
- Publisher URL
- Maintenance status
- Release history
- Dependencies
2. Confirm permissions and data-transfer scope
Review both the tool definitions and implementation to establish whether it only reads, can also write or execute, and can send data to external APIs or internal systems.
- Read
- Write
- Execute
- Network
- Secret proximity
3. Avoid risky configuration
Avoid overly broad working directories, overly powerful tokens, and ambiguous launch commands. Allow only the operations that are needed.
- Least privilege
- Restricted working directory
- Token scope
- Explicit launch command
4. Review prompt-driven operations
An MCP server connects an AI agent’s instructions to tool execution. Check that input from external pages, READMEs, tickets, or logs cannot influence risky operations.
- External input
- Tool description
- Argument generation
- Prompt injection
5. Rescan and retain operational evidence
Do not stop at the adoption-time verdict. Retain the Registry review date, provenance, permissions, and destinations so a later re-review after updates and an approval decision can be explained.
- Registry review
- Review date
- Re-review
- Destinations
- Approval decision
What Abcas MCP Guard can do
Do not decide from a checklist alone. Use the public Registry status and available inspection evidence to review a candidate server’s provenance, permissions, destinations, and data-transfer scope.
Full inspection procedure catalog
25
Baseline procedures for local MCP
22
Baseline procedures for public HTTPS
13
Applicable procedures and evidence that can be obtained vary by target. The counts for operation, dependency review, and consistency review categories (18 / 4 / 17) help organize the observations.
MCP vulnerabilities and checks before connecting →