10 checks before you trust any MCP server.
The Model Context Protocol gives AI agents direct access to your tools and data. Run these ten checks against every MCP server in your stack — before an agent does something you cannot undo.
Confirm the repository, publisher, and release signature. Unofficial mirrors and typosquatted packages are the #1 MCP supply-chain vector.
A server that auto-updates is a server you have not audited. Pin versions and re-audit on every bump.
List each tool function, its parameters, and what systems it can reach. If you cannot enumerate it, you cannot govern it.
The server should hold tokens scoped to exactly the resources its tools need — never a personal access token or admin key.
Tools that mutate state (write, delete, deploy, send) deserve separate approval thresholds from read-only tools.
Check for tools that can create credentials, modify permissions, or install other tools. These are escalation primitives.
Any tool returning external content (web pages, tickets, emails) can carry instructions back to the agent. Sanitize or wrap untrusted output.
An immutable record of what was called, by which session, with what parameters — or you cannot reconstruct an incident.
Know exactly how to revoke the server’s credentials and halt in-flight sessions, and test that path.
Servers add tools between versions. A passing audit six months ago says nothing about the tools added since.