Skip to main content

Free checklist · MCP security

Securing MCP tools: a 12-point checklist

An agent that can call tools can read a customer record, send an email or delete an account. These 12 checks cover what to put in place first.

  • 12 checks in 4 areas
  • 1-line test for each
  • SOC 2 and EU AI Act mapped
Vendor-neutral. Not legal or audit advice.

Get the full checklist

We'll email it to you straight away.

By submitting, you agree that DVARA may email you this checklist and follow up about it. See the privacy notice.

What's in it

A3 checks

Know what your agents can reach

  1. Keep a list of every MCP server and tool your agents can call
  2. Pin the server versions you run, and review changes before upgrading
  3. Vet third-party MCP servers as you would any vendor

B3 checks

Don't trust what tools say about themselves

  1. Treat a tool with no safety label as unknown, not as harmless
  2. Don't let a tool's own label decide whether it runs
  3. Classify your tools yourself

C4 checks

Control what runs

  1. Block destructive tools by default, and allow them by exception
  2. Have a person approve high-impact calls, outside the agent's own client
  3. Give each agent its own credentials and scope
  4. Remove personal data from tool results before the model sees it

D2 checks

Record and watch

  1. Record every tool call in a log that can't be quietly changed
  2. Alert on refused calls, loops and unusual volume

69%

Why this checklist

We looked at about 20,000 MCP tools. In Docker's MCP Catalog, 69% of tools that delete or overwrite something don't say so, and one server labelled 15 delete tools as read-only. This checklist turns what we found into steps a team can check.

Read the report →