MCP Security Checklist for Production

Use this MCP security checklist before shipping or materially updating any production deployment where AI hosts connect to Model Context Protocol servers — IDE integrations, internal agent platforms, or customer-facing autonomous workflows. Each item maps to a concrete control; unchecked items are documented accepted risk.

MCP standardizes tool discovery and invocation; it does not enforce your business policies, screen untrusted tool results, or isolate tenants. Application-level controls — server hardening, tool permissions, pre-execution policy, and privacy-safe monitoring — are mandatory. This checklist operationalizes What Is MCP Security? for engineering teams.

Related depth: Secure MCP Servers, MCP Tool Permissions, MCP Prompt Injection, Validate AI Tool Calls, AI Agent Runtime Monitoring.

---

1. Threat model and inventory

1.1 Inventory MCP servers and transports

Document every MCP server in each environment:

• Server name, owner team, environment (dev/staging/prod)
• Transport (stdio, HTTP/SSE, other)
• Network exposure (local only, VPC, public)
• Downstream systems and credentials per server
• Host applications that connect (IDE, agent platform, batch jobs)

Pass criteria: Central registry exists; no undocumented MCP servers in prod.

Failure impact: Shadow servers bypass review; unknown blast radius.

1.2 Inventory exposed tools per server

For each tool:

• Tool name, description (what model sees), argument schema
• Risk class: read / write / destructive / external
• Downstream API and credential used
• Max data volume per invocation

Pass criteria: Spreadsheet or manifest in version control; reviewed quarterly.

See MCP Tool Permissions.

1.3 Map untrusted content paths

List text that enters LLM context from MCP:

• MCP tool read results (tickets, files, DB rows)
• MCP resources fetched into prompts
• Web or email content via MCP fetch tools
• Multi-turn accumulation in long-running agents

Pass criteria: Diagram links sources to source-to-sink paths.

1.4 Define worst-case outcomes

Document if MCP-mediated injection or abuse succeeds:

• Data types at risk (PII, secrets, regulated records)
• Sinks at risk (send, delete, export, purchase)
• Cross-tenant exposure scenarios
• Regulatory / contractual obligations

Pass criteria: Product and security sign-off on impact assumptions.

---

2. Connection and server hardening

2.1 Authentication at deployment boundary

MCP does not provide universal auth — document your deployment model:

• Remote MCP endpoints require authentication (gateway token, mTLS, signed host tokens)
• stdio servers run under dedicated low-privilege OS accounts
• No anonymous network ingress to MCP HTTP endpoints in prod
• Dev/prod server separation — prod credentials unreachable from dev hosts

Pass criteria: Unauthenticated curl to prod MCP URL fails; documented in runbook.

Details: Secure MCP Servers.

2.2 Network isolation

• MCP servers on private subnets or local-only where possible
• Egress allowlists from servers to downstream APIs
• SSRF controls on fetch tools (block private IPs, metadata URLs, file schemes)
• WAF or API gateway on any public MCP edge

Pass criteria: Network policy test blocks RFC1918 fetch from MCP web tool.

Link: Secure Agent Web Browsing.

2.3 Credential least privilege

• Separate credentials per tool domain (read vs write vs billing)
• No admin/downstream superuser tokens on MCP servers
• Short-lived tokens where supported
• Secrets in vault — not env files on developer laptops for prod paths
• Rotation schedule documented

Pass criteria: Credential matrix matches least privilege agents review.

2.4 Server-side authorization

Independent of host policy:

• Tenant ID from authenticated host token — not model arguments alone
• Row-level filters in server implementation
• Path traversal rejected in file tools
• Batch/export caps enforced server-side

Pass criteria: Pen test cannot exfiltrate cross-tenant row via crafted MCP call with host policy disabled in test harness.

2.5 Dependency and image security

• MCP server dependencies scanned in CI
• Container images pinned and signed where applicable
• Tool manifest changes require code review

Pass criteria: CI fails on critical CVE in server image without override ticket.

---

3. Host tool exposure and permissions

3.1 Session tool allowlists

• Host registers only tools required per agent profile / task
• Write tools omitted from read-only workflows
• Destructive/admin tools absent from prod registrations
• Dynamic tool registration on scope escalation with user confirmation

Pass criteria: Agent profile manifest in config repo; write tools not in default profile.

3.2 Read/write server separation

• Optional: distinct MCP servers for read vs write with different network ACLs
• Write server connections only on approved workflows

Pass criteria: Architecture diagram shows split or documented exception.

3.3 MCP does not enforce app policy (explicit)

• Team documentation states MCP advertises capabilities; host enforces policy
• No reliance on protocol for block/review/allow semantics

Pass criteria: Onboarding doc links What Is MCP Security?.

---

4. Pre-execution validation and Agent Action Guard

4.1 Validation pipeline on every MCP tool call

• Schema validation (registered tool, argument shape)
• Session permission check
• Policy evaluation via Agent Action Guard

POST /api/v1/security/agent-action
Authorization: Bearer idapi_test_your_key_here
{
  "tool_name": "mcp_filesystem:write_file",
  "action": "write_file",
  "arguments": { "path": "/data/out.txt", "content": "..." },
  "context": "session=sess_123 tenant=acme"
}

• Synchronous evaluation before MCP client invokes server
• decision mapped to runtime: allow → execute, review → queue, block → reject

Pass criteria: Staging test shows destructive MCP call blocked with logged request_id.

Integration: Validate AI Tool Calls, Secure AI Agent Tools, docs.

4.2 Custom policy rules for MCP tools

• Rules for high-risk MCP tool names or prefixes (mcp_billing, mcp_email)
• Destructive patterns blocked
• contains_secret blocking enabled
• Default review for unmatched rules (or documented allow exception with risk acceptance)

Pass criteria: Policy JSON in version control; changes reviewed.

4.3 Human approval for review

• Review queue with SLA — not silent auto-approve
• Approver identity logged
• Denial returns safe error to agent without internal policy leak

Pass criteria: E2E test approves refund MCP call via queue.

Link: Human-in-the-Loop Agent Actions.

4.4 Per-turn validation in long sessions

• Guard runs on every turn — no cached allow across turns
• Session budgets (tool calls, cost, duration) enforced

Pass criteria: Turn 50 destructive proposal blocked. See Long-Running Agent Security.

---

5. Untrusted MCP tool results and injection

5.1 Screen tool results before re-prompting

• Each MCP tool result screened server-side at host
• Use Prompt Injection Shield

POST /api/v1/security/prompt-injection
{"text": "<mcp result>", "source": "mcp_tool_result", "context": "tool=ticket_get"}

• Verdict policy documented: safe / suspicious / unsafe

Pass criteria: Poisoned ticket body fixture does not reach model context raw.

Details: MCP Prompt Injection, Tool Output Injection.

5.2 Untrusted data framing

• MCP results wrapped with explicit untrusted delimiter in prompt assembly
• Framing documented as supplement — not replacement — for detection

Pass criteria: Prompt template review confirms framing present.

5.3 RAG and document paths via MCP

If MCP tools read indexed or file content:

• Ingest-time scanning for indexed corpora
• Indirect RAG injection controls apply
• Document injection parsers documented

Pass criteria: Poison document test fails to influence agent action.

5.4 No keyword-only filtering

• Production path uses API or multi-signal detector on MCP results
• Keyword lists supplement only

Pass criteria: Architecture review confirms. See Keyword Filter Limitations.

5.5 Follow-on sink protection

• After suspicious MCP result, external send/export tools review or block
• Source-to-sink matrix documented

Pass criteria: Web-fetch MCP + email MCP in one session triggers review rule.

---

6. Input screening upstream

6.1 User message screening

• User chat screened before LLM planning (detect prompt injection)
• Server-side execution only

Pass criteria: Direct user injection blocked before MCP tools invoked.

6.2 PII and secrets in tool arguments

• PII & secrets scanning on assembled tool context
• Agent Action Guard contains_secret rule active
• Block — not redact — when secrets in outbound tool args

Pass criteria: API key in MCP HTTP tool headers triggers block.

---

7. Output and user-visible safety

7.1 Moderate assistant messages to users

• Output moderation on user-visible completions
• Exfiltration via natural language considered (not only MCP sinks)

Pass criteria: Staging moderation blocks unsafe completion in MCP-assisted flow.

7.2 Safe rendering

• HTML/Markdown from model encoded or sanitized; CSP where applicable
• See improper output handling

Pass criteria: XSS fixture from MCP-sourced quote does not execute in UI.

---

8. Monitoring, logging, and privacy

8.1 Privacy-safe MCP telemetry

• Log: tool name, action, guard decision, request_id, session/tenant IDs, latency
• Do not log: full arguments, raw MCP results, secrets, full user prompts

Pass criteria: Log sample review passes privacy checklist.

Details: AI Agent Runtime Monitoring.

8.2 Correlation IDs

• request_id from Agent Action Guard stored per tool call
• request_id from injection scans on MCP results stored
• Correlation across turns via session_id

Pass criteria: Incident tabletop traces block event to injection scan in < 5 minutes.

8.3 Alerts

• Alert on any block decision for destructive MCP tools
• Alert on unsafe injection verdict on mcp_tool_result
• Alert on anomalous MCP tool volume per session

Pass criteria: Synthetic alert fires in staging.

8.4 Retention policy

• Security event retention documented
• Debug payload capture TTL and access restricted

Pass criteria: Privacy policy references agent telemetry.

---

9. Testing and CI

9.1 MCP tool call fixtures

• CI tests: schema fail, permission deny, destructive block, benign read allow
• Tests call POST /api/v1/security/agent-action or mock with contract validation

Pass criteria: CI green on main. See Validate AI Tool Calls.

9.2 Injection fixtures on MCP results

• Tool output fixtures for instruction override, extraction attempts
• Assert unsafe results dropped or truncated before LLM

Pass criteria: Fixtures in repo. Extend Prompt Injection Testing.

9.3 E2E MCP workflow tests

• At least one E2E: MCP read → injection in result → blocked write/send
• Long-session budget test

Pass criteria: E2E job in CI or nightly pipeline.

9.4 MCP manifest drift detection

• CI compares deployed tool manifest to approved registry
• New tool without review fails build or opens security ticket

Pass criteria: Drift test demonstrated in staging.

---

10. Incident response and governance

10.1 MCP incident runbook

• Revoke MCP server credentials procedure
• Disable tool registration in host config without full redeploy
• Query audit by session_id and request_id
• Customer notification criteria documented

Pass criteria: Runbook linked in on-call wiki.

10.2 Ownership

• Security owner for MCP platform
• Per-server operational owners
• Quarterly access review for MCP deploy keys

Pass criteria: RACI chart exists.

10.3 Cross-checklists

• Items reconciled with AI Agent Security Checklist
• Injection items reconciled with Prompt Injection Security Checklist

Pass criteria: Gap list empty or risks accepted in writing.

10.4 Developer enablement

• Onboarding links MCP checklist and runtime security
• Prompt Injection Checker available for manual probes

Pass criteria: New engineer completes MCP security module.

---

Quick reference

Ship MCP integrations when checklist pass criteria are met or exceptions are risk-accepted — not when the protocol connection alone succeeds.