MCP server checklist: 12 checks before you ship an agent

Each tool is written down: what it may read and change, and what it must never do
A written scope is what the tests and the reviewer check the server against. Adwaizer build practice
The server asks only for the access scopes its tools use
Wildcard or unused scopes widen the damage if a token or a prompt is abused. MCP specification
Every tool validates its inputs before it acts
The MCP tools specification says servers must validate all tool inputs. MCP specification
Access controls decide who may call each tool
The MCP tools specification says servers must implement proper access controls. MCP specification
Tool calls are rate limited in the server
The MCP tools specification says servers must rate limit tool invocations, so a loop cannot run away. MCP specification
A spend budget and a kill switch are enforced in the server, not in the prompt
A model can be talked out of a rule in its prompt; it cannot get around a limit in code. Adwaizer build practice
Anything that sends, pays or deletes waits for a person to approve it
The agent never takes an action that cannot be undone on its own, and a test proves one is refused. Adwaizer build practice
Tool outputs are sanitized, and outside text is marked as untrusted
Web pages, emails and records can carry instructions aimed at the model; the specification says servers must sanitize tool outputs. MCP specification
The server checks that each token was issued for it and never passes a client's token through
The MCP authorization specification forbids token passthrough, which would let one service act with another's access. MCP specification
An HTTP server follows the MCP authorization security considerations (PKCE, issuer checks)
They close known OAuth attacks such as authorization code interception and mix-up. MCP specification
A local server uses stdio or restricted IPC, not an open network port
An open local port can be reached by other programs and web pages on the same machine. MCP specification
Each tool call is logged (tokens, cost, seconds), each tool has a test with the model mocked, and secrets live in environment variables only
The log shows what the agent did and what it cost; the tests run without a paid API; no key sits in the code. Adwaizer build practice

0 of 12 done

12 left to fix:

Each tool is written down: what it may read and change, and what it must never do
The server asks only for the access scopes its tools use
Every tool validates its inputs before it acts
Access controls decide who may call each tool
Tool calls are rate limited in the server
A spend budget and a kill switch are enforced in the server, not in the prompt
Anything that sends, pays or deletes waits for a person to approve it
Tool outputs are sanitized, and outside text is marked as untrusted
The server checks that each token was issued for it and never passes a client's token through
An HTTP server follows the MCP authorization security considerations (PKCE, issuer checks)
A local server uses stdio or restricted IPC, not an open network port
Each tool call is logged (tokens, cost, seconds), each tool has a test with the model mocked, and secrets live in environment variables only

Want us to build it with you?

Our fixed-scope custom agent / MCP build delivers one MCP server or one agent with every item above in place: a written scope, scoped tools, limits in the server, a test per tool and a handover guide.

Ask about the custom agent / MCP build Our services

Not affiliated with the Model Context Protocol project or Anthropic. This checklist is not a security audit.

Is your MCP server ready to ship?

0 of 12 done

Want us to build it with you?