PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To secure an MCP deployment, audit the whole chain—not just the server. Check how the host, client, MCP server, authorization server, tools, data sources, and upstream APIs authenticate, exchange data, and enforce permissions. A correctly implemented protocol does not make every connected tool safe. The nine audits below are a practical editorial checklist, not an official MCP or OWASP framework.
How to use this MCP security checklist
Run the checks against the actual deployment and its trust boundaries. MCP deployments differ: a local server launched over stdio has different risks from a remote server using HTTP, and a read-only tool needs different scrutiny from one that can change records or trigger a sensitive action. The official MCP security documents reviewed here are under the 2026-07-28 documentation path; check the current specification and living guidance when applying the checklist.
For each audit, retain enough evidence to show what was checked and what happened: configuration snapshots, test traces, policy decisions, and relevant logs. Redact credentials, tokens, and sensitive user data. Distinguish protocol requirements from recommendations: where the specification uses MUST or SHOULD, the wording matters; OWASP guidance is best-practice advice, and the nine-part organization here is a practical synthesis.
1. Audit identity and authorization
Map every principal and trust boundary across the host, client, MCP server, authorization server, and any upstream API. Confirm that each request is authenticated and authorized independently of what the model says or intends. MCP’s security policy and OWASP’s cheat sheet are useful baselines for this review: MCP security policy and the OWASP MCP Security Cheat Sheet.
#1 Best Overall
- Test: Send an unauthenticated request, then an authenticated request for an operation the principal is not allowed to perform. Both should be denied at the appropriate boundary.
- Retain: A trust-boundary diagram, authorization policy or configuration, and redacted traces showing the expected denials.
- Remediate: Deny access by default and put explicit policy checks around sensitive operations. Do not treat model intent, a tool description, or possession of a connection as authorization.
2. Audit token audience, storage, and forwarding
Validate that tokens presented to an MCP server are intended for that server. A server must not forward a client’s MCP token to an upstream API; the authorization security considerations state: “MCP servers MUST NOT pass through the token they received from the MCP client.” Request an audience- or resource-bound token for the MCP server, then obtain a separate upstream token when the server needs to call another service. See the MCP authorization security considerations.
- Test: Present a token issued for a different resource and confirm the server rejects it. Trace an upstream call and verify it uses a separately obtained credential rather than the incoming MCP token.
- Retain: Redacted token-validation configuration, audience/resource settings, and a trace of the upstream credential flow. Do not retain usable token values.
- Remediate: Enforce audience/resource validation, keep tokens out of logs, caches, and diagnostic output, and use secure storage. The specification says short-lived access tokens SHOULD be used and refresh-token rotation for public clients MUST be implemented.
3. Audit OAuth flow and redirect defenses
For authorization code flows, check that clients use PKCE and S256 when technically capable, verify that the authorization server supports PKCE, and validate exact registered redirect URIs and OAuth state. The specification says: “MCP clients MUST use the S256 code challenge method when technically capable, as required by OAuth 2.1 Section 4.1.1.” Inspect HTTPS use for authorization endpoints and redirects as well. The same authorization security considerations describe these defenses.
- Test: Exercise the authorization flow with a mismatched redirect URI, missing or mismatched state, and an authorization server that does not advertise PKCE support. Confirm the client rejects unsafe or invalid flows.
- Retain: Redacted authorization traces, registered redirect URI configuration, and the authorization-server metadata used by the client.
- Remediate: Use exact redirect URI matching, verify state, require PKCE support, and use S256 when capable. Do not silently downgrade to a weaker flow when a required defense is unavailable.
4. Audit least privilege and scope design
Compare what each tool actually does with its scopes, credentials, and permissions. Use separate credentials per server and the narrowest practical scopes. Pay particular attention to tools presented as read-only: check whether their implementation, connected API, or indirect side effects can write data or trigger broader actions. OWASP’s MCP Security Cheat Sheet recommends limiting tool permissions and applying least privilege.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Test: For each tool, try an operation outside its stated purpose, including a write attempt through a nominally read-only path.
- Retain: A mapping of tools to scopes, credentials, and allowed operations, plus redacted test results.
- Remediate: Split capabilities and credentials where needed, narrow scopes, and enforce operation-level authorization in trusted code rather than relying on labels such as “read-only.”
5. Audit tool identity, schemas, and change control
Inspect tool names, descriptions, parameter schemas, and result schemas for unexpected capability or instructions that could alter how a model uses a tool. Determine whether definitions can change after approval and whether those changes are reviewed. OWASP’s MCP Security Cheat Sheet treats tool descriptions and schemas as security-relevant inputs.
- Test: Compare the deployed definitions with an approved baseline. Review material changes to descriptions, parameters, and result formats, and check whether a changed definition can add capabilities without renewed approval.
- Retain: Versioned approved definitions, change records, and the review or approval decision for material updates.
- Remediate: Review tool definitions as code and require renewed security review when a change affects behavior, permissions, or data exposure.
6. Audit prompt injection and data handling
Treat tool output and retrieved content as untrusted data. A result can contain malicious instructions; it must not be able to override trusted application policy, authorize a new action, or expose information the user is not allowed to see. OWASP recommends validating inputs and outputs in trusted application or server code, not relying on the model alone to interpret policy: OWASP MCP Security Cheat Sheet.
- Test: Supply retrieved content containing instructions to call another tool or reveal sensitive data. Check whether the system blocks unauthorized calls and prevents protected data from reaching the response.
- Retain: Redacted adversarial test cases, tool-call traces, and the policy decisions made by trusted code.
- Remediate: Validate and constrain calls and results outside the model. Require human approval before sensitive or destructive actions, and enforce the user’s authorization on the action itself.
7. Audit local execution, transport, and sandboxing
A local stdio server may run with the privileges of the process that launches it, so review it as executable code on the host. Check startup commands, package provenance, environment variables, filesystem and network access, process privileges, and whether the user gave informed consent. For remote deployments, review the transport and authorization protections that apply to that specific setup; verify HTTPS for remote authorization endpoints. The official MCP security best practices and authorization security considerations cover related controls.
Rank #4
- Test: Inspect the exact launch configuration and determine whether the server can read sensitive files, access network destinations, or start additional processes beyond its intended function.
- Retain: Redacted launch configuration, dependency and package review records, permission settings, and the consent or approval record.
- Remediate: Restrict privileges and access to the minimum needed; isolate or sandbox the process where feasible. Audit transport-specific protections separately rather than assuming one transport’s controls apply to another.
8. Audit state handles and cross-user access
If a server carries state between calls, a handle that refers to that state is not proof of identity. Bind it server-side to the verified principal, authorize each request, and use unpredictable handles that expire where appropriate. The official MCP security best practices and security policy inform this check.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Test: Try predictable, expired, replayed, and cross-user handles. Verify that one user cannot use another user’s handle to retrieve or change state.
- Retain: Redacted test traces showing handle lifecycle, principal binding, and access decisions.
- Remediate: Bind handles to the authenticated principal on the server, make them unpredictable, expire them when appropriate, and authorize every operation that uses them.
9. Audit supply chain, monitoring, and incident readiness
Review the server and package source, dependency integrity, version changes, and vulnerability reporting path. Monitor tool invocations and security events without recording secrets. OWASP recommends monitoring, logging, auditing, and supply-chain controls; its MCP Security Cheat Sheet also mentions mcp-scan or an equivalent for detecting poisoned tools. The official MCP security policy is relevant to vulnerability reporting.
Best Value
- Test: Review how a dependency or server update is verified, how a suspicious tool invocation would be detected, and whether responders can reconstruct an incident from available records.
- Retain: Dependency and version records, review outcomes, redacted security logs, and the documented vulnerability reporting and incident-response paths.
- Remediate: Verify dependencies and changes, monitor security-relevant events, and preserve enough redacted evidence for investigation. Avoid logging secrets or data that responders do not need.
How deployment context changes the audit
These are comparison axes for deciding where to spend review effort, not an official scoring system. The sources do not establish a universal numerical MCP risk score.
| Deployment or capability | What to examine more closely |
|---|---|
| Local stdio server | Startup command, package provenance, inherited process privileges, environment secrets, filesystem and network access, and user consent. |
| Remote HTTP server | Remote authorization and transport protections, endpoint configuration, token audience, and the boundaries between client, server, and upstream API. |
| Client-owned configuration | How the host selects and launches servers, obtains consent, stores credentials, and enforces user-facing approval. |
| Server-owned implementation | Authentication, authorization, token validation, tool execution, state isolation, logging, and upstream credential handling. |
| Read-only tools | Whether implementation or connected services can cause writes, disclose sensitive records, or trigger indirect side effects. |
| State-changing or sensitive tools | Operation-level authorization, narrow scopes, confirmation or human approval, audit trails, and recovery procedures. |
What the official guidance does—and does not—establish
The nine checks are an organizing checklist, not a canonical framework published by MCP or OWASP. MCP documentation specifies protocol requirements and security considerations; OWASP supplies broader best-practice recommendations. Neither the reviewed material nor this checklist supports a universal score or a single security verdict for every deployment. The NSA announced MCP cybersecurity information on May 20, 2026; that date is publication context, not evidence of a measured prevalence or breach rate. See the NSA announcement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
