MCP Server Security Checklist

Review MCP server access, tool permissions, input handling and security boundaries.

MCP Server Security Checklist is a 4-page PDF field guide. Access control, tool permissions, input handling and security checks.

• Treat tools as authority: Each tool exposes actions or data; descriptions do not replace enforcement.

• Separate tenants and principals: Propagate verified identity and prevent one session from crossing data boundaries.

• Validate every input: Schemas help, but servers must still enforce lengths, destinations, paths and business rules.

• Constrain outputs: Secrets, internal errors and oversized untrusted content should not flow back unchecked.

Action checklist: Inventory tool permissions; Require authentication where needed; Enforce server-side authorization; Protect against SSRF and path traversal; Redact secrets from logs and errors; Rate-limit and audit sensitive tools.

Security depends on deployment context; perform threat modeling and independent testing.