MCP Security: 9-Point Audit Checklist for Servers and Clients

Updated 15 November 2026 · Standard formula, shown below

This article answers whether there is a standard nine-point audit checklist for securing Model Context Protocol (MCP) servers and clients, and provides that checklist. MCP is an open protocol that connects AI assistants to external data and tools, and both the server and client sides need specific security checks to prevent data leakage, unauthorized access, and prompt injection attacks.

Background: What Is MCP and Why Does It Need an Audit?

The Model Context Protocol (MCP) was introduced in late 2024 as a way to standardize how AI applications (clients) connect to external data sources and tools (servers). Instead of building a custom integration for every AI app, MCP provides a common JSON-RPC-based interface. This convenience, however, expands the attack surface: a compromised MCP server can feed malicious data to the AI, and a compromised client can be tricked into executing unintended tool calls.

Security audits for MCP are not yet codified into an official standard, but security researchers and early adopters have converged on a set of critical checks. The nine-point checklist below consolidates the most commonly recommended practices from OWASP, MCP security discussions, and vendor documentation. It is intended for administrators who deploy MCP servers and for developers who build clients.

The Nine-Point Audit Checklist

Use this checklist as a starting point for your own audit. Each item includes what to verify and why it matters.

Transport Encryption – Ensure all MCP traffic uses TLS 1.2 or higher. For remote servers, this means HTTPS/WSS endpoints. For local servers, consider whether plain TCP on localhost is acceptable; if the server listens on a network interface, encryption is mandatory.
Authentication – Verify that the server requires a valid credential (API key, OAuth token, or client certificate) before accepting any request. The client must store these credentials securely, not in plaintext config files.
Authorization and Scoping – Check that the server enforces least privilege: a client should only be able to call tools and read resources that its role permits. For example, a read-only client should not have access to a tool that deletes files.
Input Validation – Inspect how the server validates all parameters in tool calls and resource requests. Malformed input should be rejected, not passed to underlying systems. This prevents injection attacks that exploit the gap between the AI’s natural language and the tool’s expected syntax.
Output Sanitization – Verify that data returned by the server is sanitized before being sent to the AI model. This is critical to mitigate prompt injection: malicious content in a database or webpage could instruct the AI to perform harmful actions. The server should strip or neutralize control characters and known attack patterns.
Tool Allowlisting – Confirm that the server exposes only the minimal set of tools needed for the intended use case. Disable any tools that are not explicitly required. For example, a customer-support bot should not have access to a database drop command.
Rate Limiting and Quotas – Check whether the server limits the number of requests per client or per time window. This prevents resource exhaustion and brute-force attempts. The client should also have timeouts and limits on how many tool calls it makes in a single conversation.
Logging and Monitoring – Ensure that both server and client log all MCP activity: who called what, when, and with which parameters. Logs should be tamper-evident and retained for a defined period. Monitoring should alert on anomalies like a sudden spike in tool calls or access from unexpected IPs.
Dependency and Supply Chain – Audit all libraries and SDKs used in the MCP server and client for known vulnerabilities. Use a software composition analysis tool. Also verify that the MCP server itself is from a trusted source and that its integrity is verified (e.g., via checksums or signatures).

How to Perform the Audit

An audit is not a one-time event; it should be integrated into your development and deployment lifecycle. Here is a practical approach:

Inventory – List all MCP servers and clients in your environment. Include the version, the data they access, and the tools they expose.
Map Data Flow – Draw a diagram showing how data moves from the client to the server and back, and where the AI model sits in that flow. Identify all trust boundaries.
Run the Checklist – Go through each of the nine points and document the current state. Use a simple pass/fail/partial rating.
Prioritize Fixes – Address any failures that could lead to data exfiltration or unauthorized tool execution first. For example, missing authentication is a critical failure, while incomplete logging is a medium risk.
Re-audit – Schedule a re-audit after any major change to the MCP configuration or after a new version of the protocol or SDK is released.

Common Problems and Misconceptions

One common misconception is that MCP is inherently secure because it uses JSON-RPC over HTTP. In reality, the protocol does not mandate any security features; it is up to the implementer to add them. Another frequent issue is assuming that localhost connections are safe. If a local MCP server binds to 0.0.0.0, any process on the machine can connect to it, and potentially other machines on the network.

A typical problem we see in audits is that developers focus on server-side security but neglect the client. The client is responsible for storing credentials and for deciding which tool calls to make based on the AI’s output. If the client does not validate the AI’s tool selection, a prompt injection could cause the client to call a destructive tool. The client should always confirm high-risk actions with the user or enforce a policy that blocks certain tools entirely.

Comparison with Other API Security Models

MCP security shares many principles with REST API security, but there are key differences. In a REST API, the client is typically a deterministic program; in MCP, the client is an AI model that may generate unpredictable tool calls. This makes output sanitization and tool allowlisting even more critical. Additionally, MCP sessions are often long-lived, unlike stateless REST requests, which means you need to handle session timeouts and revocation more carefully.

Compared to GraphQL, MCP has a similar risk of over-fetching data if the server exposes broad resources. The audit checklist addresses this by requiring scoping and allowlisting. However, MCP’s tool-calling nature introduces a new attack vector: the AI can be tricked into calling a tool with malicious parameters. This is why input validation and output sanitization are listed as separate items.

Costs and Tools for Auditing

The cost of an MCP security audit varies widely depending on the size of your deployment. For a small setup with one server and a few clients, you can do a manual audit using free tools like nmap for network scanning and openssl s_client for TLS checks. For larger environments, commercial API security platforms and vulnerability scanners can automate parts of the checklist, but they may not understand MCP-specific semantics. Budget for both internal staff time and any third-party tools you choose.

Open-source tools specifically for MCP security are still emerging. As of now, you can use general-purpose security tools and adapt them. For example, use a proxy like OWASP ZAP to intercept MCP traffic and test for injection flaws. For dependency scanning, tools like OWASP Dependency-Check can be integrated into your CI pipeline.

Frequently Asked Questions

Is MCP secure by default?

No. The MCP specification does not include any security mechanisms. It is a transport-agnostic protocol, so security depends entirely on how you implement and configure it. You must add authentication, encryption, and validation yourself.

What is the biggest security risk in MCP?

Prompt injection is the most discussed risk. An attacker can embed malicious instructions in data that the server returns, which the AI then follows, potentially causing it to call tools in harmful ways. Mitigation includes output sanitization and strict tool allowlisting.

Can I use MCP over the public internet?

Yes, but you must secure it with TLS, strong authentication, and ideally a Web Application Firewall. Never expose an MCP server without authentication, as anyone could then call your tools and access your data.

How often should I audit my MCP setup?

At least quarterly, and after any significant change to the server or client code, or after a new version of the MCP SDK is released. Also audit whenever you add a new tool or data source to the server.

What should I do if my audit finds a vulnerability?

Fix critical issues immediately, such as missing authentication or SQL injection. For medium risks, schedule a fix within a month. Document the finding and the remediation in your security log. If the vulnerability is in a third-party library, check for a patched version and apply it.

Are there any official MCP security guidelines?

As of now, the MCP specification does not include an official security annex. However, the MCP community and several security firms have published best practices. The checklist in this article consolidates the most commonly recommended measures.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.