A Model Context Protocol (MCP) server can expose useful tools to an assistant: search a repository, read a document, query data or change a system. The security question is not whether the server is convenient. It is what can the agent do if a prompt, retrieved page or tool result is malicious or simply wrong?
Inventory capabilities first
Read the MCP specification and the server’s own documentation. Distinguish read-only tools from write, delete, send, payment and administration operations. Treat vague names such as execute, fetch or run as requiring extra inspection.
Before connecting, record:
- The server publisher, update channel and installation source.
- The exact tools and resources exposed.
- Which files, repositories, accounts and networks can be accessed.
- Where credentials live and how they are revoked.
- Whether external content can trigger tool calls without user approval.
- Whether logs might contain documents, tokens or personal data.
Use least privilege
Create a dedicated identity or narrowly scoped token wherever supported. Prefer one repository over an entire organization, one read-only folder over a full drive, and a sandbox over a production shell. A connector that can read does not need permission to delete.
Require explicit approval for actions that affect others: sending messages, changing permissions, publishing code, deleting data or making purchases. An agent’s generated plan is not the same as user authorization for every side effect.
Test failure behavior
Give the tool a harmless malformed input and confirm errors do not print secrets. Check how the agent responds when a page contains text like “ignore previous instructions.” Retrieved content should be interpreted as data, not authority. Check timeout handling and whether an unexpected tool output can change the agent’s goal.
Keep a simple shutdown procedure: revoke the token, remove the tool, rotate exposed secrets and inspect the operation history.
For related model and workflow guidance, visit NexKit AI. This checklist covers permissions and process; it does not certify any particular MCP server as secure.