Auditing MCP Servers

An MCP server is a privilege boundary — it translates model-generated requests into real actions (database queries, file operations, API calls, shell commands). The model's output is shaped by user input, which makes every tool parameter an indirect injection surface. The security question is not whether the MCP server is well-coded, but whether an adversarial input to the model can cause the server to do something the user did not intend.

When to Use

• Reviewing an MCP server implementation for security issues
• Assessing tool definitions for injection risk or description manipulation
• Auditing the trust boundary between an AI agent and MCP tools
• Reviewing MCP server deployment for authentication and authorization
• Evaluating resource definitions for data over-exposure
• Checking transport configuration (stdio, SSE, Streamable HTTP) for security

When NOT to Use