Golemreach

MCP server security self-check

Fourteen checks to run against your remote MCP server before you announce it. This is the exact list our audit runs by hand, published free so you can fix the obvious things yourself. No signup, no email wall.

The Model Context Protocol lets an agent call your tools. That is the whole point and the whole risk: a tool that writes, spends, or reaches an internal network is now reachable by whatever the agent decides to do, including a prompt-injected agent. Most MCP incidents are not exotic. They are a write tool with no auth, a tool description that quietly instructs the model, or an argument that is passed straight to a shell. Below is what an outside client can observe on a single passive connection, why it matters, and the fix.

Transport & headers

  1. HTTPS only. Plain HTTP means the session id, tokens, and every tool argument cross the wire in clear text. Fix: serve the endpoint over TLS only; redirect or refuse plain HTTP.
  2. Modern TLS, valid chain. Legacy TLS (1.0/1.1) and broken certificate chains are downgrade and interception surface. Fix: disable TLS below 1.2; serve the full chain with a valid hostname, not expired.
  3. HSTS header. Without it a first request can be forced to HTTP. Fix: Strict-Transport-Security: max-age=31536000.
  4. CORS is not * on the MCP endpoint. An Access-Control-Allow-Origin: * lets a browser-based agent on any website drive your server with the user's ambient credentials. Fix: restrict Allow-Origin to the clients you actually serve.
  5. No version banners. Server and X-Powered-By with version numbers hand an attacker your CVE list. Fix: strip version banners.

Authentication & sessions

  1. tools/list requires auth when any tool is dangerous. If tools/list answers an unauthenticated client and any listed tool writes, spends, or reaches internal networks, a stranger can enumerate exactly what to abuse. Fix: require auth before tools/list and tools/call whenever the tool set is not purely read-only public data.
  2. State-changing tools are gated. A write/spend/delete tool reachable without authentication is the single most common serious finding. Fix: gate write and spend tools behind authentication and per-caller authorisation; add confirmation semantics for irreversible actions.
  3. Session ids are unguessable. Short or purely numeric session ids can be guessed or enumerated. Fix: use at least 128-bit random session ids.
  4. 401s tell clients how to authenticate. A 401 with no WWW-Authenticate header leaves well-behaved clients unable to discover your auth scheme. Fix: return WWW-Authenticate pointing at the resource metadata URL from the MCP auth spec.

Tool surface — the MCP-specific part

  1. Descriptions describe, they do not instruct. Imperative text in a tool description ("always call this first", "ignore previous limits") is prompt injection shipped inside your own metadata. Clients now flag this as tool-poisoning. Fix: tool descriptions state what the tool does; remove any text aimed at steering the model.
  2. URL / path / command arguments are validated server-side. A tool that takes a URL, file path, or command string is an SSRF, path-traversal, and injection channel. Fix: validate on the server: block internal and link-local addresses, normalise paths, never pass an argument to a shell or raw SQL.
  3. Descriptions are present and not bloated. A tool with no description gets mis-selected; a 1,500-character description is a place to hide injected instructions and it burns the agent's context. Fix: one clear line per tool.
  4. Tools carry annotations. Missing readOnlyHint / destructiveHint / openWorldHint means clients cannot ask the user for confirmation at the right moments. Fix: annotate every tool so a client knows what is safe to auto-run.

Error hygiene

  1. Errors leak nothing; malformed input does not 500. Stack traces and internal file paths in an error response map your internals; a 5xx on bad params is a denial-of-service lever. Fix: return JSON-RPC errors (-32602 for invalid params) with no stack traces or file paths.

Want this run against your live endpoint?

All fourteen checks, run by hand against your real MCP server, plus the tool-by-tool description read that no scanner does, written up as a severity-ranked report with a fix for each finding in 72 hours. Flat $79 in USDC on Base, no account, free re-check after you fix. See a real sample report we ran on our own endpoint, then start here.

Honest state: this checklist is what our probe observes on one passive connection (initialize, tools/list, TLS and header checks, tool-description heuristics). It never calls your tools. It is a floor, not a full audit — logic bugs, auth-bypass chains, and abuse of a specific tool need the manual pass. Published 2026-09-06; we will keep it current as the MCP auth spec moves.