MCP security self-check

Twelve review points, with a clear boundary between observations and tests you still need to perform.

1. Transport. Check TLS certificate validation and supported protocol versions. A network failure is inconclusive, not proof of an invalid certificate.
2. Public discovery. Decide which metadata is intended to be public. Listing tools without a token does not prove their execution bypasses authorization.
3. Protected execution — manual test. In your own authorized test environment, verify each sensitive tool rejects unauthorized callers and enforces tenant boundaries. The discovery probe does not run this test.
4. CORS. Evaluate origins and credentials together. A wildcard origin can be intentional; browsers reject wildcard origins for credentialed responses. CORS is not server authorization.
5. Sessions. Use an appropriate random identifier when your protocol profile uses sessions. Do not use a session id as authentication. One observed id cannot establish predictability.
6. Authorization discovery. For a protected endpoint, check the authentication challenge and metadata against the MCP version you implement. A 401 can be expected behavior.
7. Descriptions. Read descriptions in context. Keyword matches, imperative phrasing and description length alone are not proof of tool poisoning.
8. Input validation — manual test. Test allowed and denied URL, path and command inputs in an authorized environment. A schema merely identifies a review surface; it does not reveal whether validation is effective.
9. Annotations. Use accurate hints where helpful. MCP annotations are optional and cannot replace permissions, consent or other enforcement.
10. Error handling — manual test. Inspect error responses using an agreed test scope. A 5xx alone does not establish denial of service. The discovery probe does not send malformed requests.
11. Rate limits — manual test. Verify limits on expensive or sensitive operations within an agreed load budget. The discovery probe does not stress-test the service.
12. Evidence. Separate observed behavior, hypotheses, tests not performed and confirmed impact. Keep client reports private and exclude secrets.

Our probe performs initialization and list requests plus transport/header inspection. It never calls tools or submits malformed requests. A clean discovery report is not a security certification.

Reference: MCP authorization specification. See the corrected sample.