MCP Security
MCP server security checklist for production agents
MCP is powerful because it grants tools to agents. That also means every server should be reviewed for permissions, data access, secret exposure, and failure modes before production use.
Permission scope
List exactly what the server can read, write, execute, or send over the network. Default to read-only when the workflow allows it.
Secrets handling
Never print tokens, keys, or connection strings into agent logs. Use platform secret stores and verify behavior without exposing values.
Operational evidence
Before production, run the workflow with test data, capture tool outputs, and document rollback steps for write-capable actions.
Next steps
Turn security review into an audit-ready package
Use these pages to pick the right MCP servers, generate safe config notes, and move into the MCP Security Audit Pack when you need approval evidence.
MCP Security Audit Pack
Use permission scoring, prompt-injection review, rollout gates, and approval-ready notes.
MCP config generator
Generate server config patterns before wiring tools into your client.
MCP security checklist
Review permissions, secrets, and prompt-injection exposure before production use.
MCP directory
Return to the free directory when you need to compare safer server alternatives.