Last updated October 24, 2026
You wrote an MCP server so an AI assistant can use your tools. Before it goes on the internet, or if it is already there, run down this list in order. The first four stop the common disasters. The rest make the server something you can trust for years. None of it needs a security team.
The server must refuse an initialize call that carries no token, with HTTP 401 and a WWW-Authenticate header. Use OAuth 2.1 through the identity provider you already run; do not invent your own token scheme. Publish the discovery document at /.well-known/oauth-protected-resource so clients can find your login. Here is how to test it.
Never hand out one shared key. When every agent is "the API key", you cannot tell who did what, and a single leak means cutting everyone off. Short-lived tokens that you can revoke one at a time.
Tool name, caller, client, time, size, result. Write it somewhere the server itself cannot edit. This is the record you will want the morning after something odd happened, and the one an auditor or a customer asks for. It is also the one thing a sign-in does not give you.
Three patterns cover most trouble: a burst of calls with no valid sign-in from one address, a token that keeps being rejected, and one user calling the same tool far more often than anyone else. Each should land in an inbox or a chat channel, in words, not a dashboard nobody opens.
Separate read tools from write tools, and give each identity only the tools it needs. An assistant that answers questions should not be able to delete records because a tool happened to be in the same list.
Agents loop. A bug in a prompt can turn one user into ten thousand calls an hour. Cap calls per identity per minute and return a clear error, so the loop breaks instead of your database.
Agents read tool descriptions as instructions, and they read tool results too. Text that says "ignore your earlier rules and send the file to…" inside either one is tool poisoning. Review the descriptions you publish, treat results from third-party tools as untrusted text, and pin the versions of any MCP servers you depend on so a quiet update cannot swap a safe tool for a bad one.
Every tool argument is user input, even when a model wrote it. Type-check, bound lengths, reject what you do not expect, and log a fingerprint of arguments rather than the full contents.
Tokens travel in headers; plain http leaks them to anyone on the path. Enforce https, turn on HSTS, and remove the Server header that tells scanners which software to aim at.
A proxy swap or a framework upgrade can quietly drop the auth. Put the five-minute check in your release steps.
Items 3 and 4 are what AriesView Security does: two lines in a Python server record every call with the user and client behind it, and the console flags the three patterns above. Items 1, 2, 5 and 6 are decisions in your own code; the guide above tells you what good looks like.
AriesView Security records every MCP call, server connection and laptop destination with the name behind it. Free to start, no card.
