Security
A security checklist for remote MCP servers
The practical controls to add before an MCP endpoint can reach real customer or company data.
Define the trust boundary
Remote MCP servers sit between probabilistic agents and deterministic business systems. That boundary deserves the same care as a public API gateway, plus controls for tool discovery and model-driven invocation.
Constrain source and network access
Start with the source. Block private and metadata networks, constrain redirects, cap raw and normalized size, and pin runtime traffic to the reviewed upstream origin. Never let a submitted document silently redefine where production requests are sent.
Review tool permissions
Treat every generated tool as a permission. Default to the smallest useful set, distinguish read-only from write-capable operations, and require explicit acknowledgement for destructive behavior. Keep credentials outside the definition and inject only the credential selected for that deployment.
Authenticate and bound requests
Require bearer authentication on every endpoint, store only key hashes, support independent revocation and expiration, and avoid responses that reveal whether an endpoint exists. Bound request size, runtime concurrency, upstream response size, and execution time.
Keep useful audit evidence
Finally, record enough to investigate incidents without logging secrets or full sensitive arguments. A useful audit trail covers configuration changes, deployment revisions, key operations, request outcomes, and usage totals.