An MCP server is a new way into your systems. These are the checks we run on every connector we build or audit.
Credentials and access
- Each server uses its own credential, never a personal admin token.
- Scopes are the minimum the tools need.
- Secrets live in a secret store or environment, not in shared config files.
- If users have different permissions, the server acts as each user through OAuth.
Tools
- Read is the default. Every write tool is a deliberate decision.
- Destructive or financial actions require confirmation or are not exposed.
- Inputs are validated on the server, not trusted from the model.
- Result size and query time are capped on the server.
Prompt injection
- Tools that read untrusted content (emails, tickets, web pages) are not combined with powerful write tools in the same session without review.
- Tool outputs are treated as data. The server never executes instructions found in content.
Operations
- Every tool call is logged with user, tool, inputs and result status.
- Someone owns the server: updates, alerts and a way to switch it off.
Want us to run this checklist on your setup? See MCP setup and audit.