What should an MCP server security checklist cover?
In short: A useful MCP server security checklist covers seven areas: inventory, authorization, credentials, tools, approval, audit and operations. These 30 items follow the MCP security best practices and the OWASP MCP Top 10. Use them to review each server before it goes live, and download the CSV to track status.
Download mcp-server-security-checklist.csv
| No. | Area | Check |
|---|---|---|
| 1 | Inventory | Every MCP server is listed in a registry with an owner |
| 2 | Inventory | Every server has an environment label: development, staging or production |
| 3 | Inventory | Unregistered servers are detected and reported |
| 4 | Inventory | Local stdio servers on laptops are inventoried |
| 5 | Inventory | Each server has a named business purpose |
| 6 | Authorization | The server only accepts tokens issued for its own audience |
| 7 | Authorization | Token passthrough to downstream APIs is disabled |
| 8 | Authorization | Authorization code flows use PKCE |
| 9 | Authorization | Issuer is validated per RFC 9207 |
| 10 | Authorization | Clients are identified with CIMD where supported |
| 11 | Authorization | Scopes are minimal for each tool |
| 12 | Authorization | Each call is checked against the person the agent acts for |
| 13 | Credentials | No long-lived keys sit in MCP client config files |
| 14 | Credentials | Tool credentials are brokered by a gateway |
| 15 | Credentials | Tokens are short-lived and task-scoped |
| 16 | Credentials | Secrets are masked in logs and traces |
| 17 | Credentials | Agent access can be revoked in one action |
| 18 | Tools | Tool descriptions are reviewed before approval |
| 19 | Tools | Changes to tool definitions trigger an alert |
| 20 | Tools | Agents only see tools they are allowed to call |
| 21 | Tools | Tool output is treated as untrusted input |
| 22 | Approval | Risky tool calls require a named human approver |
| 23 | Approval | Agents cannot approve their own actions |
| 24 | Approval | Approvals are recorded in the audit trail |
| 25 | Audit | Every call is logged with agent, person, tool and outcome |
| 26 | Audit | Denied calls are logged and alerted |
| 27 | Audit | Logs are exported to the SIEM |
| 28 | Audit | Logs are retained for the period your regulator requires |
| 29 | Operations | Transport is Streamable HTTP over TLS, not legacy HTTP plus SSE |
| 30 | Operations | Servers are patched and dependencies pinned |
See all three on the checklists index, or score answers with our rubric.
By The Datasheet desk · Published and reviewed 2026-11-03