--- title: "6 Questions to Ask Before You Connect to an MCP Server" id: "4018" type: "insight" slug: "mcp-server-security-questions" published_at: "2026-11-12T15:08:49+00:00" modified_at: "2026-11-12T15:52:48+00:00" url: "https://jetstream.security/insights/mcp-server-security-questions/" markdown_url: "https://jetstream.security/insights/mcp-server-security-questions.md" excerpt: "An MCP server is code your agent will trust with real access. Here are six questions that tell you what you’re trusting before the first call runs." taxonomy_insight_category: - "AI Advisory" taxonomy_insight_type: - "Editorial" taxonomy_insight_tags: - "Agentic Identity" - "Design Control" - "MCP" - "MCP Governance" - "MCP Security" - "Supply Chain Security" --- AI Advisory # 6 Questions to Ask Before You Connect to an MCP Server An MCP server is code your agent will trust with real access. Here are six questions that tell you what you’re trusting before the first call runs. [Agentic Identity](https://jetstream.security/insights/insight_tags/agentic-identity/) [Design Control](https://jetstream.security/insights/insight_tags/design-control/) [MCP](https://jetstream.security/insights/insight_tags/mcp/) [MCP Governance](https://jetstream.security/insights/insight_tags/mcp-governance/) [MCP Security](https://jetstream.security/insights/insight_tags/mcp-security/) [Supply Chain Security](https://jetstream.security/insights/insight_tags/supply-chain-security/) JetStream Security November 12, 2026Editorial Picture a developer on your team. They find an MCP server that connects Claude or Cursor to the team’s email, tickets, or database. The included README shows one command. Thirty seconds later the server is running on that developer’s laptop, with that developer’s credentials and file access. That’s a common way for MCP servers to show up. Developers install them the way they install open-source packages: from public registries, repositories, and blog posts, often with a single command. The MCP specification’s own [security guidance](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) shows what can hide in that moment. One example it gives is a startup command that downloads a package and, in the same line, sends an SSH private key to an outside address. Compare that with a new SaaS vendor, which gets procurement review and a security questionnaire. A new MCP server often gets a skim of its README. The server also tends to get more access than the vendor would. These six questions give your team something to ask in the thirty seconds before the install. ## What you are approving An MCP server supplies more than data. It also supplies tool names, descriptions, input schemas, and results, and the model treats all of that text as guidance. The person using the agent never sees the text that caused an action. And every tool a server exposes is a permission the agent holds. So a review has to cover four things together: code, behavior, text, and access. The questions below cover all four, and most of them map to a risk on the [MCP Top 10](https://owasp.org/projects/mcp-top-10) from the Open Worldwide Application Security Project (OWASP), a nonprofit software security foundation. OWASP’s list names ten critical risks for MCP-based systems, and the entries that apply are noted by number and name below. ## 1. Who published this, and can you trace what you run back to them? A server’s name proves nothing. According to [The Hacker News](https://thehackernews.com/2025/09/first-malicious-mcp-server-found.html) , Koi Security reported in September 2025 that an npm package called postmark-mcp had copied the legitimate Postmark Labs server. Version 1.0.16, released September 17, added one line: every email the server sent was now blind-copied to an outside address. The package was downloaded 1,643 times before its publisher deleted it. Postmark said it had no involvement with the package. Your security team already has the vocabulary for this problem: software composition analysis, software bills of materials, provenance. Use it here. Ask who publishes the server, whether you can read the source, and whether the version you’re running is pinned and traceable back to that source. OWASP lists this risk as [MCP04](https://owasp.org/projects/mcp-top-10) , software supply chain attacks and dependency tampering: a compromised dependency can change an agent’s behavior or plant a backdoor. A good answer names a publisher you can verify, shows source you can read, and pins a version with a known origin. ## 2. What can each tool do, and can you turn off the ones you do not need? A read tool and a delete tool often ship in the same server. So ask for the full tool inventory, and ask whether you can switch tools off one at a time. The MCP specification’s [security guidance](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) warns against publishing every possible scope and against omnibus scopes such as admin:* and files:*, because a stolen broad token reaches everything the scope covers. OWASP calls this failure [MCP02](https://owasp.org/projects/mcp-top-10) , privilege escalation via scope creep: permissions that start loosely defined or temporary tend to grow until an agent can do far more than anyone intended. The most common version is an agent holding a delete permission it never needed. A good answer is a published tool list, per-tool controls, and no all-or-nothing bundle. ## 3. What credentials does it hold, and where do they live? Authorization in MCP is optional. The [specification](https://modelcontextprotocol.io/specification/latest/basic/authorization) says HTTP servers that support it should follow an OAuth 2.1-based flow, while local servers should skip that flow and retrieve credentials from the environment instead. In practice, that means a local server’s credentials sit on the machine where it runs, in environment variables or configuration files. The specification also forbids a specific shortcut. Servers must not accept tokens that weren’t explicitly issued for them, and [token passthrough](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) is explicitly forbidden. The reason: passing tokens through lets clients bypass controls that depend on the token’s audience, such as rate limits and monitoring, and it muddies the audit trail, because downstream logs show a different identity than the one that acted. OWASP groups this exposure under [MCP01](https://owasp.org/projects/mcp-top-10) , token mismanagement and secret exposure, which covers hard-coded credentials, long-lived tokens, and secrets that end up in logs or model memory. So ask where the server’s credentials are stored, how long they live, what they can reach, and whether the server validates the audience of any token it accepts. A good answer is specific about all four. A bare “we use OAuth” leaves them unanswered. ## 4. What happens when it sits next to the other servers your agent can reach? A server can be safe on its own and risky in combination. A [June 2026 post on the Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/06/30/securing-ai-agents-ai-tools-move-from-reading-acting/) , from the company’s Defender Experts incident response team, walks through an illustrative case. A finance team builds an invoice-handling agent in Microsoft’s Copilot Studio, and it connects to a vendor database, an email connector, and a third-party enrichment server. Every step the agent takes is legitimate: the tool was approved, the query runs with the analyst’s own permissions, and the outbound call goes to a server that was allowlisted when it was added. The post puts the weakness in “the trust boundary between them,” not in any one system. Tool descriptions add a second route. [Invariant Labs](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks) showed that a malicious server can write a description that changes how the agent uses a different, trusted server. In its demonstration, a bogus addition tool told the agent to send all emails to an attacker, even when the user named another recipient. Invariant called this tool shadowing. So ask whether the review covers every tool one agent can reach, or only the server in front of you. A good answer evaluates combinations, and it can break a risky path by removing one tool from one agent. ## 5. What happens when it changes after you approve it? Approval is a point in time, and servers change. In a [rug pull](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks) , a server changes a tool’s description after a client has approved it. [Check Point Research](https://blog.checkpoint.com/research/cursor-ide-persistent-code-execution-via-mcp-trust-bypass/) showed a version of the problem in Cursor, tracked as CVE-2025-54136 and called MCPoison. After a user approved an MCP configuration once, an attacker with write access to the shared repository could change it, and the new commands ran every time the project opened, with no new prompt. Check Point reports that Cursor 1.3, released July 29, 2025, now requires approval again for any change to an approved configuration. The same [Microsoft post](https://www.microsoft.com/en-us/security/blog/2026/06/30/securing-ai-agents-ai-tools-move-from-reading-acting/) describes this gap for descriptions. MCP picks up description changes on the fly, and in setups without a re-approval trigger, the updated text goes live without extra review. [Invariant’s mitigation advice](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks) includes pinning server and tool versions and checking an integrity hash. OWASP lists tool poisoning as [MCP03](https://owasp.org/projects/mcp-top-10) : an attacker compromises a tool, a plugin, or a tool’s output to feed the model misleading or malicious context. A good answer is a pinned version, detection of any change to tool definitions, and a new review whenever one changes. ## 6. Where does it run, and who can see what it does? A local MCP server runs with the same privileges as the client. The [specification](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) asks clients to show the exact startup command before connecting a local server, and it recommends running the server in a sandbox with restricted file system and network access. And a server nobody knows about can’t be reviewed at all. OWASP names two separate risks here. [MCP09](https://owasp.org/projects/mcp-top-10) , shadow MCP servers, covers unapproved servers that developers spin up outside formal security governance, often with default credentials. [MCP08](https://owasp.org/projects/mcp-top-10) , lack of audit and telemetry, covers the thin logging that makes investigation and incident response difficult. Security teams also typically have no inventory of which servers run on which machines. So ask where the server runs, what it can reach from there, and whether its tool calls leave a log someone can read. A good answer is a known location, restricted access, and logs your security team can query. ## When the answer is “We can’t tell” Sometimes you can’t answer these questions because you can’t see inside the server. The fastest-growing class is hosted by the vendor whose system it fronts, and you will never see the code. For those, evaluate what you can observe: the tool inventory and schemas the server publishes, the permissions each tool requests, its transport and authentication behavior, and how it behaves under test. The outcome is a risk-scored decision to accept or restrict, not a promise that the code was fixed. Whichever way you go, write the decision down: approve, restrict specific tools, or decline, and the reason. That record is what you’ll open when someone asks, months from now, why a server was allowed. ## Answer these questions once, not once per laptop Go back to that one-line install for a moment. A team that asks all six questions about every server is doing real work, and it multiplies across a dozen servers and dozens of laptops. The practical end state is one reviewed place where servers, tool lists, and approvals live, so each question gets answered once and not once per machine. JetStream’s Verified MCP Catalog™ is one example. Servers are analyzed and hardened before they’re offered, and each entry carries its tool inventory, provenance, and risk score. However your team ends up answering them, these six questions are worth asking before the first call runs. ## Stay ahead with our newsletter Stay informed on industry trends, expert analysis, and product updates. #### Explore more insights [See all Insights](/insights) [https://jetstream.security/insights/the-economics-of-ai-risk/](https://jetstream.security/insights/the-economics-of-ai-risk/) AI Advisory Oct 29, 2026 ###### The Economics of AI Risk Your board already knows how to govern capital. AI spend needs the same discipline, down to the individual agent and the person who owns it. [https://jetstream.security/insights/the-economics-of-ai-risk/](https://jetstream.security/insights/the-economics-of-ai-risk/) [https://jetstream.security/insights/ai-notetaker-legal-risk-eavesdropping-discovery/](https://jetstream.security/insights/ai-notetaker-legal-risk-eavesdropping-discovery/) AI Advisory Oct 12, 2026 ###### AI Meeting Assistants Raise Eavesdropping Concerns and Discovery Headaches A federal court has allowed wiretap and privacy claims against an AI notetaker to proceed. The harder questions may be the ones inside your own organization. [https://jetstream.security/insights/ai-notetaker-legal-risk-eavesdropping-discovery/](https://jetstream.security/insights/ai-notetaker-legal-risk-eavesdropping-discovery/) [https://jetstream.security/insights/mcp-security-risks/](https://jetstream.security/insights/mcp-security-risks/) AI Advisory Oct 5, 2026 ###### Why MCP Matters More Than You Think The protocol is where agents stop talking and start acting. [https://jetstream.security/insights/mcp-security-risks/](https://jetstream.security/insights/mcp-security-risks/) ## Top Articles 01 Editorial ### [Brazilian Court Sanctions Lawyers for Prompt Injection in Court Filing](https://jetstream.security/insights/brazilian-court-sanctions-prompt-injection-filing/) July 1, 2026 02 Editorial ### [The AI Gateway Isn’t a Cost Play. It’s a Control Plane](https://jetstream.security/insights/ai-gateway-security-control-plane/) July 21, 2026 03 Press Release ### [JetStream Security Achieves FedRAMP Class D (High) Certification Through Second Front](https://jetstream.security/insights/jetstream-security-fedramp-high-certification/) July 22, 2026 ## Featured Experts [https://jetstream.security/author-bio/patrick-zeller/](https://jetstream.security/author-bio/patrick-zeller/) ### [Patrick E. Zeller](https://jetstream.security/author-bio/patrick-zeller/) General Counsel, Legal and Compliance Patrick has spent over twenty years advising Fortune 100 companies on privacy, cybersecurity, and data protection — including... [https://jetstream.security/author-bio/keith-weisman/](https://jetstream.security/author-bio/keith-weisman/) ### [Keith Weisman](https://jetstream.security/author-bio/keith-weisman/) Head of Forward Deployed Engineering Keith brings thirty years of hands-on cybersecurity and services leadership, beginning with enterprise security consulting at Accenture and... [https://jetstream.security/author-bio/tommy-hui/](https://jetstream.security/author-bio/tommy-hui/) ### [Tommy Hui](https://jetstream.security/author-bio/tommy-hui/) Head of Sales Engineering Tommy Hui has spent more than a decade leading sales engineering at security companies, including six years at...