DEV Community

iamthat
iamthat

Posted on Originally published at rta.lat

Most MCP servers ship without a security pass. Here is the 10-check one.

#security #mcp #ai #opensource

An MCP server is not a plugin. It is an RPC endpoint that hands an LLM real capabilities: files, databases, internal APIs, payment rails. The security review should look more like an API review than a prompt review.

Here is the 10-check pass we use before exposing a server.

The 10 checks

  1. Authentication — is there any? "It is only localhost" is not a boundary on a shared machine.
  2. Authorization — can a tool be called by a session that should only read?
  3. Least privilege — does the server expose DROP, DELETE, or transfer tools when the use case only needs SELECT?
  4. Tool descriptions — can a description carry instructions that change the model's behavior?
  5. Input validation — URLs, file paths, SQL, shell arguments; SSRF and path traversal are still the classics.
  6. Secrets — are credentials in prompts, logs, or tool results?
  7. Audit and denial — can you show what was attempted and refused, not only what succeeded?
  8. Rate limits and replay — can a retry loop spend the budget or repeat a side effect?
  9. Transport and session — is the endpoint authenticated, scoped, and safe across reconnects?
  10. Supply chain — pinned dependencies, signed images, no unreviewed post-install scripts.

What the pass delivers

A written finding list with severity, evidence (request/response or code path), and a fix order. Not a certification. Not a legal opinion. A $500 review that a maintainer can act on before publishing.

The most common finding is not a sophisticated exploit. It is a write-capable tool exposed to an agent that only needed to read.

The uncomfortable question

If a user asked your server authors today, "show me that this is secure", what would they send? A README? A screenshot? A promise?

A pass gives them a document with a date, a scope, and a list of what was not checked. That is more useful than a badge.

The portfolio

Top comments (0)