Fixture-verified decision kit — reviewed September 3, 2026
Audit an MCP server before connecting it
For developers and operators who can isolate a test environment and review the permissions an mcp server requests.
Run this recipe
Work through it here
Progress stays in this browser. The downloaded Markdown kit works in any notes app or repository.
0/5 complete
Is this recipe useful?
Procedure
- Record the exact repository, revision, package or image digest, startup command, transport, and publisher before executing anything.
- Inspect manifests, install hooks, tool definitions, requested credentials, filesystem roots, network destinations, and destructive operations; deny every permission the stated job does not require.
- Scan supported lockfiles or SBOMs with OSV-Scanner and inspect individual OpenSSF Scorecard findings, treating both as incomplete signals rather than approval.
- Run the pinned server without production secrets in a disposable environment with one read-only fixture, restricted filesystem access, and denied-by-default network access.
- Exercise every tool's normal path, denied-permission path, malformed input, and confirmation boundary; connect a real account only after recording the approved scope, revocation path, owner, and review date.
Acceptance artifact
A versioned MCP preflight record with provenance, permission ledger, dependency evidence, negative tests, and an approve, pilot, or reject decision
Do not use it blindly
A clean vulnerability scan or high repository score does not prove an MCP server is safe; do not run untrusted install scripts, grant broad production credentials, or let an agent approve its own permissions.