Resources
MCP server enterprise-ready security rubric
An MCP server is enterprise-ready when an agent can call its tools without gaining implicit standing, leaking secrets, or executing attacker-controlled side effects. This rubric is a scoring sheet, not a marketing claim about any specific server.
Model Context Protocol servers sit on the boundary between language models and real systems: files, tickets, cloud APIs, and sometimes shells. Grade each server before you connect it to production agents, then enforce those controls at runtime with UnitOne Gateway.
Security rubric
- 1
Identity and authentication
Every tool call must be attributable to a service identity or user. Reject anonymous transports in production. Prefer short-lived credentials, SSO, or workload identity over long-lived static tokens embedded in agent configs.
- 2
Authorization and tool scope
Expose the smallest tool surface the workflow needs. Separate read tools from write/execute tools. Bind authorization to the calling principal and tenant, not to 'the agent is internal.' Dangerous tools (shell, arbitrary HTTP, unrestricted file write) should be off by default.
- 3
Secret and data handling
Secrets must not appear in tool descriptions, sample prompts, traces, or model context. Responses should redact credentials, session tokens, and personal data. If a tool fetches customer content, define retention and whether that content can re-enter a prompt.
- 4
Untrusted input and prompt injection
Treat tool arguments, retrieved documents, and third-party web content as untrusted. Do not let retrieved text choose which tool runs next without policy. Validate schemas, canonicalize paths, and block unexpected protocols or destinations.
- 5
Network and execution sandbox
Pin egress to known destinations. Disable unused transports. If the server can run code or commands, sandbox it, drop privileges, and cap CPU, memory, and time. Record the execution host so incidents are investigable.
- 6
Logging, monitoring, and response
Log authentication outcomes, tool name, caller, policy decision, and a redacted argument digest. Alert on bursty tool use, denied calls, and first-time use of high-risk tools. Keep a kill switch that revokes a server or tool without redeploying every agent.
- 7
Supply chain and change control
Pin versions, review dependency diffs, and require a reviewed change for new tools or permission expansions. Third-party servers need a named owner, an update channel, and a tested rollback. Intent-preserving fixes should land as pull requests against the server repo, not silent hotpatches.
Frequently asked questions
- What makes an MCP server enterprise-ready?
- An enterprise-ready Model Context Protocol server authenticates callers, scopes tools to least privilege, keeps secrets out of prompts and logs, treats tool input as untrusted, and produces an audit trail. If any of those are missing, treat the server as a prototype — not production infrastructure for agents.
- Why do MCP servers need a different rubric than REST APIs?
- MCP servers expose tools that an agent may invoke with attacker-influenced context. The failure mode is not only broken auth; it is an agent chaining a benign-looking tool into data exfiltration, code execution, or lateral movement. The rubric therefore weights tool scope, untrusted input, and change control as highly as transport security.
- How should we score third-party MCP servers?
- Score them the same way you score internal servers, then add supply-chain checks: publisher identity, release signing, dependency freshness, and whether you can pin a version. Do not connect a community server to production agents until it passes authentication, secret handling, and tool-scope controls.
- Should we still scan community MCP servers?
- Yes, as a due-diligence step. UnitOne Gateway is the product that governs tool calls at runtime. A standalone MCP scanner is a legacy helper, not a Gateway SKU and not required to start free.
Inspect MCP tool calls in Gateway
Start free to inspect and block unsafe MCP tool use at runtime. See plans for Team and Enterprise event volume. A standalone MCP scanner is legacy and is not on the pricing grid.