# MCP security deployment checklist

Revision: 2026-08-26  
Target MCP revision: 2026-07-28

Record the reviewer, build identifier, protocol revision, and evidence link for
each checked item. Keep tokens, tool payloads, personal data, and private host
names out of the checklist.

## Identity and authorization

- [ ] Every HTTP request carries authorization in the header, never in the URL.
- [ ] The server validates issuer, audience, expiry, signature, and required scope.
- [ ] Tenant and object access come from verified identity, not tool arguments alone.
- [ ] State handles are random, expire, and are bound server-side to the principal.
- [ ] The server rejects upstream or downstream tokens that were not issued for it.
- [ ] Initial scopes are narrow; privileged tools use an explicit step-up flow.

## OAuth client and proxy

- [ ] PKCE, issuer, redirect URI, and state validation have negative tests.
- [ ] A proxy records consent per user and client before third-party authorization.
- [ ] The consent view shows the client, exact redirect URI, and requested scopes.
- [ ] OAuth discovery and every redirect hop pass the production SSRF policy.
- [ ] Private, loopback, link-local, and cloud-metadata destinations are blocked in
      production unless a documented exception applies.

## Tools and human approval

- [ ] Tool inputs use strict schemas and the handler validates them again.
- [ ] Authorization is checked inside the handler for the exact resource and action.
- [ ] Annotations and descriptions are treated as untrusted metadata.
- [ ] Sensitive calls show full arguments and require approval outside model control.
- [ ] Retries, timeouts, rate limits, and idempotency match each tool's side effects.
- [ ] Tool output is validated and separated from instructions before model reuse.

## Local servers and supply chain

- [ ] Installation shows the exact command and source before execution.
- [ ] The process starts with the smallest file, network, and OS privileges it needs.
- [ ] Local HTTP listeners are authenticated and restricted; stdio is preferred when
      no other process needs access.
- [ ] Package identity, checksum or signature, and dependency review are recorded.
- [ ] A catalog or schema change triggers a diff, security review, and renewed consent
      where the risk changes.

## Audit and release evidence

- [ ] Logs contain actor, tenant, tool, decision, result, latency, and correlation ID.
- [ ] Log tests prove that tokens, secrets, raw personal data, and sensitive arguments
      are redacted or omitted.
- [ ] Cross-tenant, wrong-audience, expired-token, hostile-output, and approval-bypass
      cases fail in CI or a dated security exercise.
- [ ] The rollback path removes the new server or tool without leaving credentials,
      listeners, or scheduled work behind.
- [ ] One named owner accepts every exception with an expiry date.

Licensed under CC BY 4.0. Attribution details are in `LICENSE-CC-BY-4.0.md`.