Checklist: securing MCP servers and AI agents
For: Development teams and IT leads with AI agents
Updated: 2026-11
An MCP server is secured in seven steps: narrowly limit the use case, grant least privilege per tool, use dedicated credentials instead of shared accounts, tie consequential actions to human approval, treat content from external sources as data, log all calls and introduce new servers through an approval process.
An MCP server gives an AI model access to real systems. Every permission of the server thus becomes a permission of the agent.
This checklist covers securing your own and purchased servers. Context is in our article on MCP and AI agents.
The checklist
- 01
Limit the use case
Define which tasks the agent should perform and which tools are needed.
Done when: The use case and required tools are recorded in writing.
- 02
Grant least privilege
Only necessary rights per tool; separate read and write tools.
Done when: Every tool has documented rights and none has admin rights without justification.
- 03
Use dedicated credentials
Use dedicated, rotatable credentials per server or the signed-in user’s rights.
Done when: No server uses shared admin accounts and keys are managed securely.
- 04
Require approval for consequential actions
Tie payments, deletions, external messages and permission changes to human confirmation.
Done when: A list of actions requiring approval exists and is enforced technically.
- 05
Protect against prompt injection
Treat content from emails, documents or websites as data and block dangerous tools in such contexts.
Done when: Test cases with injected instructions were run and blocked.
- 06
Log all calls
Record user, agent, tool, parameters and result of every call.
Done when: Logs can be analysed and a sample has been reviewed.
- 07
Approval process for servers
Check new servers, especially from external sources, before use and record them in the AI inventory.
Done when: Every server in use is recorded in the inventory with origin, rights and owners.
Common mistakes
- —Running a server with an admin account because it is fastest.
- —Giving agents that read external content write tools at the same time.
- —Installing servers from unknown sources without review.
- —Starting without logs and being unable to trace anything in an incident.
What this checklist does not cover
- —The checklist does not replace a security review of the specific implementation.
- —The protocol and available security features keep evolving.
- —Data protection and possibly the AI Act must also be checked when agents process personal data.
Parent service: SaaS Product Development
Matching offers
Production readiness review for LLM features
The review checks an LLM feature before launch for what demos do not show: prompt injection attacks, quality measured against a fixed evaluation set, data flows and contracts with model providers, cost per use, monitoring and AI Act classification. The result is a prioritised action plan.
AI integration strategy
An AI integration strategy establishes where artificial intelligence creates genuine value in your organisation — and where it does not. It identifies use cases, assesses feasibility and benefit, prioritises, and delivers a plan that builds in AI Act conformity from the start rather than retrofitting it.
FAQ
Is it enough to trust the model?
No. Models can be influenced by injected content. Security comes from permissions, approvals and isolation, not from the model.
Who should approve MCP servers?
Those responsible for AI governance and information security, together with the business unit.
How do you test prompt injection?
With test cases where documents or emails contain instructions, checking whether the agent executes them.
More checklists
Checklist: creating a first business continuity plan
A first business continuity plan is created in seven steps: identify critical processes, assess the impact of an outage, set recovery objectives, describe fallback procedures for each critical process, make contacts available offline, exercise the plan and update it regularly.
Checklist: optimising a Google Business Profile
A Google Business Profile is optimised in seven steps: verify the profile, choose the right primary category, record name, address, phone and opening hours correctly, describe services, upload real photos, gather and answer reviews fairly and keep details consistent with website and directories.
EU AI Act conformity: a checklist for the first pass
A workable first pass through the EU AI Act has six parts: know which AI runs in the business, determine your role for each system, classify under Article 6, check transparency duties separately, ensure AI literacy, and file everything so it can be found under scrutiny.