The MCP checklist

Most MCP servers are local processes a desktop AI client starts from a config file in a home directory. They hold long lived credentials, they are not sandboxed, and nothing in an identity provider, a CASB or a network log will ever name one.

• Endpoints are scanned, not only the networkcritical 35A local server started over stdio never makes an outbound connection you can see. If discovery stops at traffic and sign-in logs, the entire local surface is invisible, including every server on a laptop nobody has signed into for months.
• No credential is written in cleartext into a client configcritical 30An API key typed into a JSON file is a credential with no rotation, no expiry and no owner. Replace the literal with an environment reference and move the value into the operating system keychain.
• Any config holding a credential is owner onlyhigh 20On macOS every account shares the staff group, so a group readable config is a shared secret. Set it to owner only, then rotate, because another local account could already have read it.
• No credential is passed as a command line argumenthigh 15Process lists are readable by every account on the machine. A token in the arguments is a token everyone local already has, and it reaches process creation auditing and shell transcripts as well.
• No config file can be rewritten by another accountcritical 30A writable config, or a writable folder above it, lets a local attacker add a server the client loads without a new prompt. Documented client flaws in 2026 worked exactly this way.
• No MCP container mounts the Docker socket or runs privilegedcritical 35The host Docker socket is root on the machine, and privileged mode removes most of what a container isolates. Either one makes the container boundary decorative.
• Filesystem servers are scoped to a project, never to a drive root or a home directorycritical 30A filesystem server rooted at home turns every file the account can read into model context, reachable by anything that can influence what the model reads.
• Packages are pinned, and nothing is fetched and run at launchhigh 20An npx or uvx launcher pulls from the registry and executes on every start, so a compromised release lands without a single config change. Install once at an exact version, or pin a digest.
• Remote servers use https and an authentication method you can namehigh 25Plain http sends the credential across the network in the clear. A remote server with no token in its config is either using an OAuth flow that stores it elsewhere, or it is protected by nothing but its URL.
• A definition that changes after approval raises an alertcritical 35The command, the arguments, the variable names or the host can all change on an entry you already approved. That drift is how a reviewed server becomes a hostile one, and it is the half a one-time inventory cannot do.

A gateway earns its place by what it refuses. These are the gates that hold when an agent is confused, when a token is replayed, and when a tool somebody disabled this morning is still registered on an open session.

• Tenant identity comes from the verified token and nowhere elsecritical 35Never from a header, a query parameter or a request body. One accepted hint from the caller is a cross-tenant read, and the database should be the authority on isolation rather than application code.
• Authorization is OAuth 2.1 with PKCE and rotating refresh tokenshigh 25Consent is remembered per user, per client and per server, so five servers do not mean five browser round trips. Cross-tenant is checked when authorization starts and again at consent, because a server can move while a ticket is still live.
• Tokens are audience bound to one servercritical 30The audience is the server URL and a second claim names its id, both derived at issue time so the refresh path cannot drift. A token minted for one server is refused on every other, and a legacy token with no server claim is refused everywhere.
• Each integration is addressable in its own righthigh 20One server per integration, each with its own protected resource, state, tool inventory and audit lineage. A single catch-all endpoint makes every grant a blanket grant and every log line ambiguous.
• Writes require an explicit grant and no role bypasses itcritical 30An owner is not an exception. A stored write grant that does not name its approver was auto granted under an older policy and is void. Where several gates read the same grant, the weakest one decides.
• The tool list is the permission surfacehigh 25A tool the caller may not run is never registered, so the model gets each tool's real parameters instead of one loose object, and it never spends a turn on a call it will be refused on.
• A tool's risk class is read on every call, never at session registrationcritical 30Sessions outlive decisions. If the gate reads the value captured when the client connected, an admin disabling or reclassifying a tool changes nothing until that client disconnects.
• The call carries the caller's own vendor credentialhigh 20Then the vendor's own audit names the human, and their vendor permissions bound the call. A missing credential is a structured answer naming the connect URL, with no silent fallback to a shared connection.
• Third-party servers are revalidated on every call, redirects includedcritical 30A host that resolves publicly today can resolve to a link-local address tomorrow, and a default HTTP client follows redirects without rechecking the destination. Validate, resolve and pin every hop, and require https, because the call carries the credential.
• Revocation covers tokens already issued and tokens not yet mintedhigh 25A cutoff invalidates what exists, a block refuses to mint more, and both are checked on verification and on both issuance paths. Otherwise a revoked user simply refreshes.
• Nothing upstream leaks backhigh 20Never return vendor tokens, never echo the authorization header, and never reflect a vendor error body. A reflected response is what turns a blind request forgery into a readable one.
• A failed tool sync changes nothingmedium 15If a sync error is written as an empty inventory, an expired vendor token reads as the vendor having deleted every tool, and the gateway quietly disables a working integration.

The part that decides whether any of this survives an audit, a leaver, or a Monday morning. It includes the limits worth stating out loud, because a control that quietly overclaims is worse than one you know you are missing.

• Every call is logged down to the vendor tool it reachedhigh 25Actor, tenant, server, the tool called and the upstream tool it proxied to, with payload sizes. A log that stops at the gateway boundary cannot answer who moved the record.
• Access is time boxed and taken back on the deadlinehigh 20An expiry that depends on somebody remembering is not an expiry. The sweeper that removes access should write the same audit line a human removal would.
• Requests and approvals work in Slack, Microsoft Teams and the apphigh 20One decision, one audit line, three front doors. A flow that exists in only one of them pushes half the company into email, and that half leaves no record.
• There is a kill switch and somebody has tested it this quartercritical 30Per agent and per tenant, effective on tokens that are already out. An untested kill switch is a slide, not a control.
• Every agent has a named human ownermedium 15A non-human identity with no owner survives every offboarding, every access review and every reorganisation. Ownership is what makes the other controls actionable.
• Approving a definition never clears a finding about one copy of ithigh 20This command with these variable names is fine. That is a different statement from this laptop writing the token in cleartext being fine. Keep definition findings and install findings in separate counts.
• A scan that could not read everything retires nothingmedium 10A locked file or a missing disk permission must not make servers look gone. An inventory that silently retires what it failed to read reports progress nobody made.
• Attribution is shown as inferredmedium 10An endpoint scan cannot prove who uses a machine. Render the signed-in address as a hint with its source, and let an admin override it, rather than printing it as an identity claim.
• Rescoring the fleet is a server side changemedium 15The endpoint should emit observations from a fixed vocabulary and let the server own the weights. Otherwise changing your mind about a risk means pushing a new binary to every laptop.
• The agent on the endpoint never executes what it discoversmedium 15It reads config files an attacker may have written. Running what they name is the exact vulnerability it exists to report, so the scanner should have no way to execute at all, enforced by a test rather than by review.
• The scoring version is recorded on every rowmedium 10When a weight changes, you need to find exactly which findings an older engine judged. Without a version stamp, a rescore is a guess and a trend line is fiction.