Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What should I check before installing an MCP server? Treat it as executable code with access to tools, data, credentials, or external services—not as a harmless plug-in. Verify its publisher and installation path, understand every tool’s effects, and assess the controls around authorization, isolation, human approval, and monitoring. MCP authorization is optional at the protocol level, so a deployment must not assume it is present automatically; choose controls for the server’s exposure and the sensitivity of what it can do.
This checklist separates protocol-specific authorization requirements from broader implementation practices. The linked MCP guidance is in the 2026-07-28 security best-practices documentation and the 2026-07-28 authorization security considerations. Check the current applicable specification and guidance when reviewing a live implementation, because these documents can evolve.
1. Establish what you are installing
1. Verify the publisher and source
Confirm the project identity, maintainer, official repository or registry entry, and exact package name. Search-result placement and a similar-looking name are not proof of legitimacy. OWASP warns about untrusted packages and typosquatting; record the source you verified and compare the package name character by character.
Evidence to collect: the official project page, maintainer identity, repository or registry URL, and exact package identifier. If you cannot establish that these refer to the intended project, do not install it.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
2. Review the complete installation command
Before running a local server’s setup or startup command, inspect the whole command and the configuration it consumes. Check whether it downloads or executes a binary, runs a script, changes system settings, or passes secrets and paths as arguments. MCP’s security best practices identify malicious startup commands and downloaded binaries as local compromise paths.
Evidence to collect: the exact command, its source, the files or binaries it downloads, and the configuration values it reads. Do not run a command you cannot explain.
3. Inspect code, dependencies, and integrity evidence
Review the source code where feasible, examine its dependencies for known vulnerabilities, and verify supplied checksums or signatures against the publisher’s stated values. A listing in a registry does not establish that code is safe or that an artifact matches reviewed source.
Evidence to collect: the reviewed release or commit, dependency scan results, and any available checksum or signature verification. Treat missing integrity evidence as uncertainty, not as proof of tampering or safety.
2. Understand the server’s actual capabilities
4. List every tool and its real effect
Build an inventory of tools and record what each can read, write, delete, send, or execute. Include external APIs, databases, files, and other services the server can reach. A tool’s name is not enough to establish its effect; follow the implementation and configuration to the operation it performs.
Evidence to collect: the tool inventory, its data sources and destinations, and whether each operation is read-only, changes state, or can trigger an external action.
5. Inspect descriptions, parameters, and schemas
Read the full tool definitions—not just their names—including descriptions, parameter names and types, constraints, and return schemas. Metadata can carry instructions that influence a model, while an overly broad or ambiguous parameter can expose more capability than the tool’s label suggests. OWASP’s MCP Security Cheat Sheet treats tool metadata and schemas as security-relevant surfaces.
Evidence to collect: a saved copy of each reviewed definition and notes on unexpected instructions, unconstrained inputs, or excessive return data.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →6. Detect changes to tool definitions
Record the tool definitions you approved and compare them when the server or its metadata changes. Re-review changes before continuing to trust the server: a modified definition can alter what an existing integration asks a model to do. Pinning or recording a definition can reveal metadata changes, but it cannot prove that the code or behavior behind unchanged metadata is unchanged.
Rank #2
Evidence to collect: a versioned definition record, a change-detection method, and a named review step for changes. Treat a changed definition as a reason to reassess the affected capability, not as proof that the underlying implementation is safe.
7. Reduce tools and permissions to what the job needs
Remove unused tools and capabilities, then grant the smallest access required for the declared task. Apply particular scrutiny to write, administrative, financial, and data-sharing operations. The OWASP MCP guidance recommends least privilege as an implementation control; it is not a blanket MCP protocol requirement that every server expose a particular permission model.
Evidence to collect: the approved tool list, the reason each capability is needed, and the permissions assigned to it. Unnecessary access is a deployment finding to remove rather than a capability to leave enabled “just in case.”
3. Review identity, authorization, and secrets
8. Scope credentials separately for each server
Avoid sharing one credential across unrelated servers. Prefer narrowly scoped, short-lived tokens where supported, and do not grant broad API scopes when the task needs only read access. A compromise of one server should not automatically provide credentials for other services or capabilities.
Evidence to collect: each server’s credential owner, scope, lifetime, and downstream access. If a shared credential is unavoidable, document the exposure and the reason it cannot be separated.
9. Protect secrets at rest
Use the operating system’s secure credential store where appropriate. Do not leave OAuth tokens or other secrets in plaintext configuration files, logs, or settings that are broadly readable. Check both the server’s configuration and the client or host that launches it.
Evidence to collect: where credentials are stored, which users or processes can read them, and whether logs or diagnostic output expose them.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
10. Authenticate remote access to protected resources
If a remote endpoint exposes non-public tools or data, require authentication and enforce authorization on each protected request. MCP authorization is optional at the protocol level; a deployment must explicitly decide how access is controlled rather than infer that the protocol supplies authentication by default.
Evidence to collect: the endpoint’s authentication configuration and tests showing that unauthenticated and unauthorized requests cannot reach protected operations.
11. Validate token audience and claims
For an authorization-protected MCP server, verify that each inbound access token was issued for that server and validate its relevant claims. Reject a token intended for another resource. The MCP authorization security considerations say that servers must validate inbound tokens and accept tokens intended for themselves; they also disallow passing an MCP token through to a downstream service as though it were a credential for that service.
Evidence to collect: the token-validation configuration and negative tests for wrong-audience or otherwise invalid tokens. The same security page states: “A MCP server MUST follow the guidelines in OAuth 2.1 – Section 5.2 to validate inbound tokens.”
12. Check OAuth metadata discovery and PKCE
For implementations using the MCP HTTP authorization profile, verify the required authorization-server metadata discovery behavior and support for PKCE. Use the S256 challenge method when technically capable, and fail closed if a required PKCE capability is absent. This is a profile-specific authorization check, not a requirement for every MCP server regardless of transport or authorization setup.
Evidence to collect: the discovered authorization metadata, the PKCE method used, and test results showing how the client handles missing or unsupported required capability. Consult the applicable MCP authorization security considerations for the current profile requirements.
13. Verify HTTPS, redirects, and authorization-flow state
In the HTTP authorization flow, authorization endpoints must use HTTPS. Confirm redirect URIs are registered and validated exactly, reject unexpected or changed destinations, and verify that state is present and matches what the client generated. These checks help prevent authorization responses from being redirected to an unintended destination or accepted in the wrong flow.
Evidence to collect: the registered redirect URI, tests for altered destinations, and tests that reject missing or mismatched state. The relevant profile guidance is in the MCP authorization security considerations.
Recommended Free Tools
14. Prevent OAuth proxy confused-deputy behavior
If an OAuth proxy connects users to third-party APIs, check how it associates consent with clients. Consent should be recorded per MCP client; a consent cookie from an earlier client must not silently authorize a newly registered client without user approval. This check is specific to deployments acting as that kind of proxy.
Evidence to collect: the client identity bound to each consent decision and a test in which a newly registered client cannot reuse another client’s prior consent. See the MCP authorization security considerations.
4. Protect the boundary between instructions, data, and actions
15. Treat retrieved content and tool responses as untrusted
Documents, webpages, email, tool descriptions, schemas, and tool results can contain malicious instructions. Keep a clear boundary between content the system should treat as data and trusted instructions. Microsoft’s April 28, 2025 article, Protecting against indirect prompt injection attacks in MCP, describes how indirect prompt injection can be embedded in external content such as documents, webpages, or email.
Rank #4
Evidence to collect: the handling rules for retrieved content and tests using untrusted material that attempts to redirect the model or trigger an action. Do not treat a server response as trusted merely because it came from an approved server.
16. Validate inputs before execution
Model-generated parameters are untrusted input. Validate types, allowed values, paths, and command arguments before a tool acts. Avoid passing raw shell commands or unchecked file paths to an execution layer; constrain inputs to the operation the user actually authorized.
Evidence to collect: validation rules and negative tests for malformed, out-of-range, or unauthorized parameters. OWASP’s MCP Security Cheat Sheet provides implementation guidance on validation and tool execution.
17. Validate outputs before reuse
Constrain and sanitize server outputs before placing them into later tool calls or model context. A result is not just display text if another step can act on it: it may become the input to a subsequent operation. Preventing unsafe input at the first tool boundary does not remove the need to check data passed between steps.
Evidence to collect: the transformations and limits applied to outputs, plus tests showing that hostile or malformed responses cannot steer a later action without validation.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors18. Constrain URL fetching and network destinations
A tool that fetches a URL can be manipulated into contacting internal services or cloud metadata endpoints. Use explicit destination allowlists and SSRF defenses suited to the environment; do not let model-supplied URLs freely choose where the server connects. The MCP security best practices and OWASP’s MCP guidance address these implementation risks.
Evidence to collect: allowed destinations, network egress controls, and tests for attempts to reach disallowed internal or metadata addresses.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Isolate the runtime and control network exposure
19. Sandbox local processes
Run local servers with minimal operating-system privileges, restrict accessible directories and network access, and isolate sensitive services. A stdio connection avoids exposing a listening endpoint, but it does not restrict the process’s access to files, networks, or credentials on the host.
Evidence to collect: the process identity, filesystem and network restrictions, and the boundary separating the server from sensitive host resources. OWASP’s MCP Security Cheat Sheet provides deployment guidance on sandboxing.
20. Check remote endpoint exposure
For Streamable HTTP, use TLS. Bind local HTTP services to localhost unless wider access is required, validate incoming Origin and Host headers, and reject unexpected origins or hosts. These checks address who can reach an endpoint and which origins or hostnames it will accept; they do not replace authentication and authorization for protected tools.
Evidence to collect: the bind address, TLS configuration, accepted Origin and Host values, and tests for unexpected values. Consult the MCP security best practices for implementation guidance.
6. Keep consequential actions controlled and observable
21. Require meaningful approval for sensitive calls
Require explicit user confirmation before destructive, financial, or data-sharing actions. Show the actual tool-call parameters so the user can understand what will happen, and ensure model-generated content cannot bypass the confirmation step. An approval prompt that hides the destination or effect does not give the user meaningful control.
Evidence to collect: the confirmation screen or interaction, the exact parameters shown, and tests that an action cannot proceed without approval. This is an implementation control described in OWASP’s MCP guidance and the NSA’s May 2026, Version 1.0 report, not a universal protocol-level approval requirement.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute22. Limit abuse and duplicate effects
Set appropriate rate limits, quotas, and timeouts for the server’s exposure and operations. For actions where repetition could cause harm, examine idempotency and replay behavior: MCP does not automatically solve every application-level duplicate-action or replay problem.
Evidence to collect: configured limits, timeout behavior, and tests for repeated or replayed requests on consequential operations. The NSA’s May 2026, Version 1.0 security design considerations emphasize traditional controls such as authentication, authorization, and input validation alongside agentic-system risks; they do not quantify MCP incident prevalence.
23. Log and monitor securely
Record tool invocations, relevant user context, parameters, and timestamps for audit; send appropriate events to monitoring and alert on unusual tools or call patterns. Redact secrets and personal data from logs, review configuration routinely, and conduct security exercises to test whether controls work in practice.
Evidence to collect: sample audit records, redaction behavior, alert rules, and a review or exercise record. OWASP’s MCP Security Cheat Sheet and the NSA report offer implementation and organizational guidance for these practices.
How to make the installation decision
Use the findings to make a documented decision, not just to complete a checklist. Block installation or continued use when you cannot establish the package’s identity, cannot explain its execution path, or find that sensitive capabilities are reachable without appropriate authorization or containment. Also block a deployment when a critical weakness leaves destructive or data-sharing actions exposed without meaningful approval, or when a remote endpoint accepts access it should reject. These are deployment decisions based on the server’s actual access and impact, not a claim that every recommendation above is an MCP protocol MUST.
- Approve: the intended source and release are verified, capabilities and access are understood, required authorization works, and applicable controls have evidence.
- Restrict before approval: remove unnecessary tools, reduce permissions or network destinations, add isolation, or require approval for consequential operations, then test the revised configuration.
- Reject or defer: a material risk cannot be mitigated or verified, or the evidence is insufficient to justify the access requested.
For OAuth deployments, use the current MCP authorization requirements alongside the broader OAuth baseline in IETF RFC 9700, published in January 2025. RFC 9700 is OAuth 2.0 security best-current-practice guidance; it is not a substitute for determining which MCP profile requirements apply to the server under review.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
