# MCP Server Security Checklist: 25 Controls for AI Agents

Audit MCP server security with 25 source-backed controls covering authentication, permissions, prompt injection, secrets, sandboxing, logging, revocation, and allow-or-deny tests.

## Quick Answer

Secure MCP server connections to AI agents before any tool can act. Validate authentication and token audience, avoid token passthrough, grant least-privilege read-only access first, block secrets and undeclared network destinations, log high-impact calls without sensitive payloads, and prove revocation works. Human approval and attributable audit logs are KyenAI operational recommendations for destructive or production actions, not requirements imposed by the MCP specification.

## Best for

Engineering leaders, security reviewers, platform teams, and developer tooling owners.

## Use this guide to

Answer how to secure an MCP server with source-backed protocol checks and clearly labeled operational controls.

## Recommended play

1. Inventory one named server and version, including owner, publisher, methods, data classes, credentials, network reach, dependencies, and deployment environment.
2. Validate official MCP authentication and authorization behavior, including token audience, scopes, deny paths, and token-passthrough protection.
3. Launch with the narrowest read-only profile, then review write, delete, network, secret, and production capabilities as separate permission decisions.
4. Use MCP Inspector to test expected allow and deny cases, record evidence, and prove that disablement and credential revocation work.

## MCP security launch decisions

Distinguish protocol-specific requirements and guidance from general operating controls before approving an MCP server.

| Area | Claim basis | Security decision | Launch gate |
| --- | --- | --- | --- |
| MCP authentication | Official MCP authorization specification and security guidance | Validate token audience, metadata, scopes, and deny paths; do not pass through unrelated tokens | Authorization tests prove accepted and rejected token behavior |
| MCP permissions | Official least-privilege guidance plus local capability policy | Request minimal scopes and review read, write, delete, network, secret, and production access separately | Every enabled scope and method maps to a declared workflow |
| Human approval | KyenAI operational recommendation | Require an informed decision immediately before destructive or production actions | The prompt identifies actor, target, action, environment, and rollback limits |
| Attributable logs | KyenAI operational recommendation | Record actor, session, server version, method, target, approval, timestamp, and outcome | A reviewer can reconstruct a consequential call without exposing secrets |
| Network isolation | Official SSRF guidance plus KyenAI deployment controls | Validate URLs and redirects; allowlist destinations and block private or metadata endpoints | SSRF, redirect, DNS, and undeclared-destination tests pass |
| Revocation | KyenAI operational recommendation informed by MCP token guidance | Disable the server, revoke credentials and client access, preserve records, and assess affected data | The owner proves emergency disablement and names incident contacts |

## Execution steps

1. **Record the server profile** — Name the owner, publisher, version, distribution source, methods, resources, prompts, data classes, credential source, network destinations, dependencies, and deployment environment.
2. **Verify authentication and scopes** — Test protected resource metadata, token audience, minimal scopes, rejected tokens, incremental elevation, and the absence of token passthrough for HTTP-based MCP authentication.
3. **Complete the permission matrix** — Decide repository read, write, delete, outbound network, secret access, and production access separately. Document each default, data risk, approval, logging expectation, and launch gate.
4. **Validate with MCP Inspector** — Enumerate exposed protocol features, exercise expected allow and deny cases, inspect errors and protocol exchanges, and retain evidence for the reviewed server version.
5. **Prove revocation and incident response** — Disable the server, revoke tokens and secrets, remove client access, identify retained records, and confirm who evaluates affected systems before production approval.

## Common pitfalls

- **Calling every control an MCP requirement**: Tie normative language only to official MCP evidence. Label human approval, attributable audit logs, read/write separation, and review cadence as KyenAI operational recommendations.
- **Granting one broad MCP permission bundle**: Review repository read, write, delete, outbound network, secret access, and production access as independent capabilities with separate launch gates.
- **Testing only the happy path**: Use MCP Inspector and direct authorization tests to prove denied scopes, invalid audiences, undeclared destinations, and disabled capabilities stay blocked.
- **Logging secrets in the name of auditability**: Record identifiers and outcomes, not token values or unnecessary payloads. Test redaction before launch.

## Implementation checklist

- [ ] Record the server owner, publisher, version, distribution source, and deployment environment.
- [ ] Classify methods, capabilities, data classes, credentials, network reach, and dependencies.
- [ ] Validate MCP authentication, token audience, minimal scopes, and denied authorization paths.
- [ ] Keep secrets and tokens out of prompts, source control, tool output, and ordinary logs.
- [ ] Separate repository read, write, and delete permissions.
- [ ] Deny outbound network, secret access, and production access until independently approved.
- [ ] Require human approval for destructive or production actions as an operational control.
- [ ] Retain attributable, secret-redacted audit records as an operational control.
- [ ] Validate resources, prompts, tools, notifications, and allow or deny behavior with MCP Inspector.
- [ ] Test server disablement, credential revocation, incident contacts, and restoration criteria.

## FAQ

**Q: What are MCP tool permissions boundaries?**

MCP tool boundaries should be defined at the tool level, not only at the server level: decide which tools are visible, which are callable, which are read-only, and which require explicit approval before write, delete, network, secret, or production access.

**Q: What should you review before launching an MCP server for coding agents?**

Review authentication, token audience, scopes, read/write separation, secret isolation, network allowlists, audit logs, human approval for high-impact actions, and a tested revocation path before the agent can reach the server unattended.

**Q: Who should own MCP security review?**

Engineering leaders, security reviewers, platform teams, and developer tooling owners who can inventory the server owner, methods, credentials, deployment environment, and rollback plan before rollout.

## Evidence sources

- [MCP security best practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices) — MCP. Official guidance for least privilege, token security, SSRF, sessions, and local server compromise.
- [MCP authorization specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization) — MCP. Official requirements for HTTP authorization, protected resource metadata, tokens, scopes, and audience validation.
- [MCP authorization security considerations](https://modelcontextprotocol.io/specification/draft/basic/authorization/security-considerations) — MCP. Official security considerations for token passthrough, SSRF, session threats, and local server compromise.
- [MCP Inspector](https://modelcontextprotocol.io/docs/tools/inspector) — MCP. Official interactive workflow for validating resources, prompts, tools, notifications, and protocol exchanges.

## Related guides

- [MCP tool discovery debugger](/guides/mcp-server-not-showing-tools) — Prove tools are discovered and enabled before applying production security controls to their use.
- [Claude Code hooks and MCP setup](/guides/claude-code-hooks-mcp-setup) — The setup page explains where MCP belongs in the broader Claude Code control map.
- [repository instruction files](/guides/agents-md-vs-claude-md-cursorrules-copilot-instructions) — Instruction files are where teams should document safe tool usage and escalation rules.
- [loop engineering for AI coding agents](/guides/loop-engineering-ai-coding-agents) — MCP servers inside unattended loops need scoped permissions, observation tools, and stop rules before scaling.

---
Canonical: https://www.kyenai.com/guides/secure-mcp-servers-ai-coding-agents