Source-led security workflow · September 3, 2026
Before connecting an MCP server, audit the command and blast radius.
An MCP configuration can be an instruction to execute local code with your client's privileges. Review the executable, permissions, and failure paths before convenience turns into ambient access.
The trust boundary changed
The protocol's current security guidance warns that a local MCP server may run with the same privileges as its client, access local files, execute commands, or reach the network. For HTTP servers, authorization adds separate risks around token audiences, redirect targets, scope, and server-side request forgery.
That does not make every server unsafe. It means the right unit of review is the exact server version, command, permissions, and environmentânot the directory listing or tool description.
A six-step preflight
- Pin provenance: Record the repository, revision, package or image digest, publisher, transport, and exact startup commandâincluding every argumentâbefore executing anything.
- Inspect before installing: Read manifests, lifecycle hooks, tool definitions, requested credentials, filesystem roots, network destinations, and destructive operations. Do not run an untrusted install script merely to inspect its dependencies.
- Use scans as evidence: Run OSV-Scanner against supported lockfiles or SBOMs and inspect individual OpenSSF Scorecard findings. A clean scan and a high aggregate score are incomplete signals, not approval.
- Write the permission ledger: For filesystem, network, credentials, commands, and external mutations, write down what is requested, what the job actually needs, what the first run receives, and how denial should behave.
- Run a disposable fixture: Use no production secrets, one read-only fixture, restricted filesystem roots, and denied-by-default network access. Observe files, child processes, destinations, and tool-list changes.
- Test refusal and removal: Exercise normal, malformed, denied-permission, and confirmation paths for every tool. Approve a real connection only after the scope, owner, review date, and revocation steps are recorded.
Two checks that are not enough
No known vulnerability found. Dependency databases cover known advisories in recognized packages. They do not prove the application logic, unpublished code, install hooks, configuration, or runtime behavior is safe.
The repository has a good Scorecard result. Scorecard checks maintenance and supply-chain practices. Read each finding and its limitation; an aggregate number does not approve the permissions your specific job grants.
Use the free worksheet
The MIT-licensed kit contains the provenance record, permission ledger, negative-test table, transport and authorization checks, disposable-run evidence, and final decision gate.
Disclosure: Software Sausage also operates a free-demo and $1/month MCP experiment. Apply this same preflight to it; payment is not a security signal.
Primary sources
Get the next field test
One maintained recipe each week. Explicit opt-in, no vendor-paid ranking, unsubscribe any time.