MCP security checklist for AI agents in production

Record the publisher, source, version, transport, and every exposed tool. For each tool, note whether it reads, writes, spends, publishes, or reveals data. That map determines which controls are required.

• Pin versions and review changes before updating.
• Disable tools that are not needed.
• Separate test and production servers and accounts.

Give each agent or environment a distinct identity. A shared token makes attribution and revocation difficult. Store secrets in the runtime's secret manager, inject them at startup, and keep them out of prompts, logs, and versioned configuration.

• Start read-only.
• Limit scopes and token lifetime.
• Test rotation and revocation instead of only documenting them.

Treat model-generated arguments as untrusted. Validate schema, size, format, currency, market, URLs, and identifiers inside the tool. Inspect responses before returning them to model context so external content cannot become a privileged instruction.

• Allow network domains and destinations explicitly.
• Reject unknown values instead of silently correcting them.
• Redact secrets and personal data from errors.

Approval is appropriate before spending, publishing, contacting a person, revealing contact details, or performing any irreversible action. The review screen should show the exact action, amount, currency, target, and expiration.

Link each MCP call to a request identifier and agent identity. Log the tool, outcome, human decision, and applied policy without storing secrets. Alert on repeated denials, call spikes, new destinations, and budget overruns.

• Test prompt injection, replay, timeouts, double clicks, and unavailable approvers.
• Prepare an emergency stop and credential revocation procedure.
• Retain enough audit data to reconstruct the action.