An MCP server is effectively an API that agents call for people, and that gives it an unusual set of risks. The caller is a model that text from elsewhere can steer, the human may never see individual calls, and whatever you return might be read by yet another model. Most problems are familiar API errors amplified by that chain, so this checklist groups twenty checks by layer, with the reasoning for each.
Transport: HTTPS only, validate the Origin header on every request (the spec requires it, to stop DNS rebinding), bind local servers to localhost and treat session IDs as untrusted. Authorisation: decide per tool what's public, publish protected-resource metadata, validate token audience and never pass a client's token through to another API.
Input: validate every argument server-side, bound lengths and counts, never accept raw SQL, shell or file paths, and parameterise database calls. Output and prompt injection: treat submitted text as hostile, keep tool descriptions honest and static (changing them after approval or hiding instructions in them are known attacks), and return only what the output schema promises.
Abuse and operations: rate-limit by IP and tool, annotate tools truthfully but enforce rules server-side too, cap anything that pings a human, return safe errors and log calls. I end with simple ways to test your own server.
Key takeaways
- Validate the Origin header on Streamable HTTP endpoints
- Never forward tokens issued for someone else
- Reject raw query, shell or path arguments
- Keep tool descriptions static and honest
- Rate-limit write tools and log every call
Related on BuiltToWinWeb: how to add an MCP server to a website
Read the full guide on BuiltToWinWeb: The MCP server security checklist
A summary by Jacob Campbell of an article first published on built2winweb.com on October 5, 2026.