Public engineering checklist · 2026

MCP / Tool Governance Checklist

Use this before giving an agent broader tool authority. It is a planning and review artifact — not a penetration test, certification or proof that every tool path is secure.

See the bounded audit Scope one boundary

Inventory & ownership

List every MCP server reachable by the representative workflow.
List relevant tools/resources, versions and transport.
Name the owner for each server and business owner for consequential actions.
Flag third-party, unknown and unowned servers.

Action classification

Classify each tool as read, internal write, customer-facing write, delete/destructive, financial, credential/security, deployment/code execution or external communication.
Require an explicit business reason for every high-impact capability.

Identity & authorization

Identify the identity that actually acts.
Check token/resource audience binding.
Check for token passthrough assumptions.
Review credential scope, lifecycle and revocation.
Flag shared or unnecessarily broad credentials.

Gateway / policy

Identify the intended control point and bypass paths.
Check how unknown tools are treated.
Separate read/write/delete policy where applicable.
Document fail-open vs fail-closed behavior.

Human approval

Bind approval to exact action, target and material parameters where required.
Record approver identity and expiry.
Check that stale approval cannot be reused after parameter changes.

Evidence & failure

Reconstruct actor → decision → tool → result → resulting state.
Test ambiguous timeout/retry where safe.
Check idempotency/deduplication for material effects.
Preserve retry/replay lineage and unresolved partial work.

Current protocol note

Review against the deployed MCP revision.

MCP 2026-07-28 introduced a stateless protocol core and required Mcp-Method and Mcp-Name headers for Streamable HTTP requests. Its authorization guidance requires tokens to be issued for the MCP server as intended audience/resource and forbids passing the inbound client token unchanged to downstream APIs.

Official 2026-07-28 release ↗
Official authorization specification ↗

Evidence discipline

Use PASS / PARTIAL / FAIL / NOT TESTED / N/A.

Do not collapse a multi-domain MCP environment into a fake universal security score. Preserve what was tested, what was not, and which owner decision follows.