August 2026 · GaleOps
Model Context Protocol (MCP) servers give AI agents direct access to files, APIs, and external systems. That access is the whole point - and the whole risk. Here's a concrete checklist to run through before any MCP server touches production.
The system prompt must state that content retrieved via tools is DATA, never instructions. If your server relies on the model "knowing better," you don't have a security model.
Each tool should have the narrowest possible scope. A read_file tool doesn't need write. An email tool doesn't need arbitrary recipients. Audit each tool's actual parameters against what it's granted at the process level.
Any tool that sends data outside the system (email, webhooks, API calls with side effects) must trigger a human confirmation gate before execution. This single control breaks most exfiltration chains.
Tool poisoning works by hiding instructions inside tool descriptions, which the model reads as context. Review every description: if it contains imperative language directed at the model ("always do X first"), that's a red flag.
If multiple users hit the same MCP server, verify that User A's conversation context can never influence User B's session. Shared state across sessions enables cross-user injection.
Not just prompted - enforced. A read_file tool should reject paths outside its sandbox at the code level, independent of whatever the model requests.
API keys, tokens, and connection strings must live in environment variables or a secrets manager - never in the system prompt where they become readable via prompt extraction attacks.
You can't detect exfiltration you can't see. Log: which tool was called, with what arguments, by whom, and what data moved. Ship logs somewhere agents can't modify.
A compromised agent shouldn't be able to dump an entire database in one burst. Rate-limit each tool's invocations to a sane ceiling for legitimate use.
Dedicated service account, no shell access, filesystem scoped to what's needed. If the agent gets fully compromised via prompt injection, the blast radius is capped by the OS permissions of the MCP server process.
MCP SDKs and tool libraries are supply-chain targets. Pin versions, audit for known CVEs, and review new dependency updates before pulling them in.
Every item above is theory until tested. Run prompt-injection attacks against your own server: indirect injection through tool output, instruction override via user input, cross-session poisoning, and exfiltration chaining. The free GaleOps scanner automates 5 attack patterns against your agent's system prompt in ~3 minutes.
A hardened MCP server has: explicit instruction hierarchy, allowlisted tools with validated parameters, confirmation gates on external sends, full invocation logging shipped off-box, and a record of real attack testing - not just a code review.
GaleOps runs fixed-price MCP security assessments: config audit, injection surface mapping, tool permission review, and exfiltration path analysis, delivered as a prioritised report in 5 business days.
See the $3,500 Assessment →The free prompt-injection scanner runs 5 real attack patterns against your system prompt in about 3 minutes. No signup.
Run the Free Scanner →