01 · Know every tool and side effect
Inventory available tools, versions, input schemas and whether each call reads, writes, exports data, triggers a payment or changes permissions. Evidence: versioned tool inventory and a documented owner.
Free practical resource · November 2026 · For developer and security teams
MCP server security checklist: 12 questions to answer before an enterprise deployment
An AI agent that can call tools can also change records, send messages and trigger external actions. These questions help your team identify what is enforced at the API boundary, what is only logged, and what evidence an enterprise buyer can actually verify.
View the checklistSee a synthetic evidence review
Independent guidance, not a certification. This is an educational checklist. Answering every question does not guarantee security, legal compliance or approval by any enterprise buyer. Privi's paid human services have separately agreed scopes.
The 12-point checklist
02 · Authenticate the real caller
Validate credentials and token audiences at the protected endpoint. Can a log identify the tenant, person and delegated agent rather than a generic shared key? Evidence: documented authorization flow and test cases.
03 · Enforce least privilege on every call
Bind access to an exact user, tool, operation and business resource. Confirm the server rejects forbidden actions even if the model supplies a convincing explanation. Evidence: negative authorization tests.
04 · Validate inputs and outputs
Reject malformed or out-of-scope values. Avoid treating scraped webpages, tool responses and uploaded documents as trusted instructions. Evidence: schema-validation and adversarial-input tests.
05 · Require explicit approval for high-impact actions
For irreversible or sensitive actions, verify approval outside the agent context, bound to the exact target and arguments. Prevent reuse when parameters change. Evidence: signed or reliably attributable approval records.
06 · Distinguish decision from execution
An agent decision or gateway log is not proof a downstream application performed a change. Seek separately authenticated action acknowledgments and result digests where needed. Evidence: request-to-result reconciliation.
07 · Stop replay and duplicate effects
Use unique request IDs, expirations and idempotent handling for retries, particularly for billing or write actions. Evidence: double-submit, retry and timeout test results.
08 · Preserve tenant isolation
Test that one organization's agent cannot read another tenant's data, logs or configuration through tool parameters or shared sessions. Evidence: cross-tenant denial tests.
09 · Control changing tool definitions
Monitor server identity, signatures, installed dependencies, tool descriptions and schema changes. An approved server or tool may change later. Evidence: release pinning and change-review process.
10 · Restrict secrets and downstream credentials
Keep payment keys, OAuth tokens and customer secrets outside model-readable prompts, public repositories and raw logs. Define a revocation and rotation process. Evidence: secret scanning and least-privilege storage.
11 · Make failures and logs interpretable
Record actor, policy, action, status, retries and failure mode without logging confidential payloads. Identify which fields are self-reported and which have independent confirmation. Evidence: safe export and retention policy.
12 · Rehearse outages and recovery
Verify rate limits, dependency failures, failed payments, incident contact, restore procedures and notification responsibilities. Evidence: tested runbooks and ownership matrix.
Three questions for your next buyer demo
If I revoke a user's permission right now, which MCP tool calls can still succeed?
For one approved write operation, can you show the actual downstream execution result, not only the agent's intent?
When an agent retries an uncertain action, how do you prevent duplicate real-world effects?
If the team cannot answer these with concrete evidence, start with one tightly scoped workflow instead of a broad “enterprise-grade” claim.
What a paid Privi review includes—and does not
Privi World Corp offers manually delivered, separately scoped consultations and evidence mapping. A buyer and Privi must agree in advance on the workflow, permitted artifacts and expected deliverables. The work is not a penetration-test certification, regulatory opinion or an automatically deployed security product.
Security review · $99
Discuss tool permissions, untrusted inputs, authorization boundaries and design risks.
Agent evidence review · $149
Map a single workflow's available decision, approval and execution-evidence records.
MCP integration consultation · $249
Discuss API, authentication and pilot architecture; implementation is not included.
Use non-sensitive descriptions when contacting us. Never email credentials, regulated records or production secrets. The listed Stripe links pay for human services, not automatic API-key access or tokens.
Related primary security resources
This checklist is Privi's own practical synthesis of widely discussed risks. For more detailed engineering guidance, consult the OWASP MCP Security Cheat Sheet, OWASP Securing Agentic Applications V2, and the MCP 2026-07-28 specification release notes. Their projects do not endorse or certify Privi.