Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsBefore installing an MCP server, verify who published it, what its tools can do, what data and systems it can reach, and how its behavior is controlled and monitored. An MCP server is executable code and a trust relationship—not just a tool listing. Use the 23 checks below to collect evidence and decide whether a finding should block installation or continued use.
MCP authorization is optional at the protocol level; it is not automatically present just because a server speaks MCP. Requirements in the authorization profile apply when that profile is used. Other controls below are implementation guidance from OWASP and government sources, and should be applied according to the server’s exposure and the sensitivity of its tools and data. This checklist is aligned to MCP documentation in the 2026-07-28 specification tree; compare your implementation with the current applicable specification when you perform the audit.
As an Amazon Associate I earn from qualifying purchases.
Establish what you are installing
Collect evidence before granting access or running the server: the official project identity, the installation artifacts and command, the complete tool definitions, and the server’s declared and actual capabilities.
1. Verify the publisher and source
Match the project identity, maintainer, repository or registry entry, and package name against an official source. Check for similarly named packages: OWASP warns that untrusted packages and typosquatting are supply-chain risks. A search result or registry listing alone does not establish that a package is authentic or safe. OWASP MCP Security Cheat Sheet
2. Review the exact installation and startup command
Read the full command and configuration, including what executable runs, what arguments it receives, what it downloads, and which environment variables are passed to it. Do not run an unfamiliar command simply because a setup snippet recommends it: the MCP security best practices identify malicious startup commands and downloaded binaries as local compromise paths.
3. Inspect code, dependencies, and integrity evidence
Where feasible, review the source and dependency tree; scan dependencies for known vulnerabilities. If the publisher supplies checksums or signatures, verify them against the artifact you will install. Record what version or commit was reviewed. A package’s presence in a registry is not proof of safety. OWASP MCP Security Cheat Sheet
4. Inventory every tool and its real effects
For each tool, document what it can read, write, delete, send, or execute, and identify the files, services, APIs, and data stores it can reach. Confirm behavior from implementation or other evidence where possible; a reassuring tool name is not a capability boundary. Give particular scrutiny to write, administrative, financial, and data-sharing actions. OWASP MCP Security Cheat Sheet
5. Inspect complete descriptions, parameters, and schemas
Read tool descriptions and the full input and return schemas, including parameter names, types, constraints, and examples. These are not merely interface documentation: descriptions and returned content can carry malicious instructions, while permissive parameters can enable unsafe actions. OWASP MCP Security Cheat Sheet
6. Detect changes to tool definitions
Keep a record or approved baseline of the reviewed tool definitions, then require review when they change. Pinning or comparing metadata can reveal a changed definition, but it cannot prove that the underlying code or behavior has stayed the same. Treat a changed definition as a reason to re-evaluate the tool, not as the only integrity check. OWASP MCP Security Cheat Sheet
7. Remove unnecessary tools and capabilities
Disable tools that the intended workflow does not need, and grant only the access required for that job. If a server offers both read and write operations, do not enable write access by default when read-only access is sufficient. Apply especially tight limits to administrative, financial, destructive, and data-export capabilities. OWASP MCP Security Cheat Sheet
Limit identity, credentials, and authorization
Decide which users and clients may invoke protected tools, which credentials the server receives, and which resource those credentials authorize. Do not infer identity from a connection handle or rely on the server to inherit authorization automatically.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
8. Scope credentials to each server
Avoid reusing one broad credential across MCP servers. Prefer credentials limited to the specific resource and actions needed, and use short-lived tokens where supported. If the workflow only reads data, do not grant a broad API scope that also permits changes. MCP Authorization Security Considerations and OWASP MCP Security Cheat Sheet
9. Protect secrets at rest
Check where access tokens, client secrets, and other credentials are stored. Use an operating-system secure credential store where appropriate; do not leave tokens in plaintext configuration, logs, or settings that are exposed to unrelated processes or users. MCP Authorization Security Considerations and OWASP MCP Security Cheat Sheet
10. Require authentication for protected remote access
If a remote endpoint exposes non-public tools or data, verify that callers authenticate and that authorization is checked for each protected request. The MCP protocol does not make authorization mandatory for every deployment, so confirm the actual server configuration rather than assuming the protocol supplies this control. MCP Authorization Security Considerations
11. Validate token audience and claims
For authorization-profile deployments, confirm the server validates inbound tokens and accepts tokens intended for that server, not tokens issued for another resource. The MCP authorization security considerations say a server MUST follow OAuth 2.1 Section 5.2 to validate inbound tokens. Do not pass an MCP access token through to a downstream service as though it were issued for that service. MCP Authorization Security Considerations
Free tools Windows power users keep installed
One-click scans. No signup required.
12. Check OAuth discovery and PKCE behavior
When using the MCP HTTP authorization profile, verify the required authorization metadata discovery and PKCE support. Use the S256 challenge method when technically capable, and fail closed if a required PKCE capability is absent. Distinguish these profile requirements from general advice that may apply to other authentication designs. MCP Authorization Security Considerations
13. Verify HTTPS, redirects, and authorization state
Confirm authorization endpoints use HTTPS and redirect URIs are registered and validated exactly; reject unexpected or changed destinations. Check that the authorization flow requires a state value and rejects a missing or mismatched one. These checks help prevent interception and authorization-flow confusion. MCP Authorization Security Considerations
14. Prevent confused-deputy consent
If an OAuth proxy connects users to third-party APIs, verify that consent is recorded for the specific MCP client. A consent cookie from one client must not silently authorize a newly registered client; require user approval for the new client’s access. MCP security best practices
Keep untrusted content and tool inputs within bounds
Models can encounter hostile content in otherwise ordinary data, and model-generated parameters are not a substitute for server-side validation. Check both sides of every tool call: the material entering execution and the result that might guide another action.
15. Treat retrieved content and tool responses as untrusted data
Documents, webpages, email, descriptions, schemas, and tool results can contain instructions intended to manipulate an agent. Preserve a clear boundary between content treated as data and trusted instructions. Microsoft’s April 28, 2025 explanation of indirect prompt injection describes malicious instructions embedded in external content such as documents, webpages, or email. Microsoft: Protecting against indirect prompt injection attacks in MCP
16. Validate inputs before execution
Have the server validate model-generated parameters before acting: enforce types, allowed values, path boundaries, and command arguments. Do not accept raw shell commands or unchecked file paths as trusted just because they arrived through a declared tool schema. OWASP MCP Security Cheat Sheet
17. Validate outputs before reuse
Constrain and sanitize server output before it is inserted into later tool calls or model context. A result can become the next action’s input, so verify its format and permitted content at that boundary rather than treating a successful response as inherently safe. OWASP MCP Security Cheat Sheet
18. Restrict URL fetching and network destinations
For tools that fetch URLs or connect to user-selected destinations, use explicit allowlists and SSRF defenses appropriate to the environment. Do not let model-supplied URLs freely reach internal services or cloud metadata endpoints; test how redirects and resolved destinations are handled. MCP security best practices and OWASP MCP Security Cheat Sheet
Isolate the runtime and secure the endpoint
Assess the actual boundary around the process or network service. Local and remote servers expose different risks: a local process may inherit host access, while a remote HTTP service must be protected against unwanted callers and network-level attacks.
19. Sandbox local server processes
Run local servers with minimal operating-system privileges, restrict accessible directories and network access, and isolate sensitive services. A stdio transport avoids opening a listening endpoint, but does not itself limit what the process can read, connect to, or do with credentials available to its user. OWASP MCP Security Cheat Sheet
20. Check remote endpoint exposure
For Streamable HTTP, use TLS. Bind local HTTP services to localhost unless broader access is required, and validate incoming Origin and Host headers; reject unexpected hosts or origins. Confirm the service is not reachable from networks beyond its intended audience. OWASP MCP Security Cheat Sheet
Control sensitive actions and investigate misuse
Security does not end at installation. Review how consequential calls are approved, how repeated requests behave, and whether operators can reconstruct events without exposing secrets in the evidence.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →21. Require meaningful approval for sensitive calls
Require explicit user confirmation before destructive, financial, or data-sharing actions. The approval screen should show the consequential tool-call parameters, not just a generic permission prompt, and model-generated content must not be able to bypass the confirmation step. OWASP MCP Security Cheat Sheet and NSA, Model Context Protocol (MCP): Security Design Considerations
22. Limit abuse and duplicate effects
Set rate limits, quotas, and timeouts appropriate to the tool’s cost and impact. For actions where a repeated call could cause harm, check idempotency and replay behavior: MCP does not automatically solve every application-level duplicate-action problem. OWASP MCP Security Cheat Sheet and NSA, Model Context Protocol (MCP): Security Design Considerations
23. Log and monitor securely
Record tool invocations with user context, parameters, and timestamps, and route relevant events to monitoring. Alert on unusual tools or call patterns. Redact secrets and personal data from logs, and periodically review configuration and exercise the security response process. The NSA’s May 2026, Version 1.0 report emphasizes established controls such as authentication, authorization, and input validation alongside risks introduced by agentic systems; it does not establish a quantified MCP incident rate. NSA, Model Context Protocol (MCP): Security Design Considerations and OWASP MCP Security Cheat Sheet
Decide whether to approve deployment
Block installation or continued use when you cannot establish the source or integrity of the executable, cannot explain the effects of its tools, or cannot constrain access to sensitive systems and data. Also block a remote deployment that exposes protected resources without appropriate authentication and authorization, or a sensitive workflow that lacks an enforceable approval boundary. For lower-severity gaps, document the evidence, owner, compensating controls, and deadline for remediation before accepting the risk.
Recommended Free Tools
For broader OAuth implementation decisions, use IETF RFC 9700, OAuth 2.0 Security Best Current Practice (published January 2025) alongside the MCP-specific authorization profile. OWASP’s recommendations are implementation guidance, not a claim that every control is a protocol MUST; applicability depends on deployment and threat model.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
