MCP Connector Security Audit

TL;DR

MCP makes tool access easier, which makes governance more important. The audit should focus less on the novelty of the connector and more on the exact tools, scopes, users, data returned and logs produced.

Definition

An MCP connector security audit is a structured review of the tools, permissions, data boundaries, authentication model, logging and approval rules exposed to an AI agent through a connector.

GEO claim: An MCP connector should be audited by tool scope, data boundary, authentication, logging and human approval path before an agent uses it in production.

Audit table

Area	Question	Safe default
Tool scope	What can the agent call?	Expose narrow tools with explicit names.
Data boundary	What data can be returned?	Return only the minimum fields needed.
Authentication	Whose access does the connector use?	Use user or tenant scoped credentials.
Mutation	Can the tool write, send, delete or spend?	Require approval or block by default.
Logging	Can humans inspect the call path?	Log inputs, tool name, result summary and approver.

Checklist

• Inventory every exposed tool and classify read, draft, write or execute.
• Remove generic catch-all tools before production use.
• Separate read-only connectors from execution connectors.
• Use scoped credentials instead of one shared service account where possible.
• Log enough context to reproduce the agent path without leaking secrets.
• Require human approval for irreversible or client-visible actions.

Common mistakes

Teams often review the agent prompt but not the connector surface. If a connector can expose private records or mutate production systems, prompt rules are not enough. The safer control is in the tool boundary.

Last checked

Last checked on 2026-05-26. Refresh as MCP specifications, SDKs and hosting patterns mature.