Check MCP permissions: account, server and client

Write down a concrete task first: read one specific repository and summarize three known files, for example. That gives you a target, required permissions and an answer you can verify. The permission planner combines runtime, intended access and content source into checks for your own environment. It connects to neither your account nor a server and does not rate providers. Start in a separate test area whose contents you already know.

Which layer enforces each boundary?

Hiding a tool does not automatically change the account permissions at the provider. Conversely, a restricted role can reject an operation even when its tool appears in the list. Record both observations separately. During a later handover, the next operator needs to know whether a restriction lives at the source, in the server or in the client. Do not put access tokens in the record: a role name, target identifier and configuration version provide the necessary context without disclosing credentials.

Local process or remote service

For a local process, inspect the package source, version and arguments before starting it. Also consider the operating-system account that launches it. The word stdio does not restrict files or network access. For a remote service, verify the documented HTTPS address and the account you use to sign in. Compare requested permissions with the task before granting access. The authentication guide explains OAuth and API keys; the transport guide explains the connection path.

Third-party content remains data

A web page, message or issue can contain text phrased as a new instruction. This is one route for Prompt Injection. For a bounded exercise, create your own harmless test note that suggests an additional, unrequested step. Observe whether the workflow stays within the agreed task. Passing this exercise is not a general security certification: different content can behave differently. Restrict reachable destinations and review consequential calls individually. Even read-only access can expose confidential information if a later step sends the retrieved content to another destination.

Checks before the first deployment

1. Record a small task, the expected record and destinations that are explicitly out of scope.

2. Choose a test account or a limited role. Inspect the exposed tools without issuing a production write operation.

3. Run an allowed read test. Compare its content, destination and scope with the expectation you recorded beforehand.

4. Test boundaries only in your own authorized test area. Record which request was rejected and whether the destination stayed unchanged.

5. Revoke the test connection, reconnect and check which access remains possible. Account for documented credential validity periods.

If the permissions remain unclear, stop before calling a tool with production data and ask the operator about its actual effects. For a reading task, continue with the read-only checklist. For connection problems, use the troubleshooting navigator. A broken connection and a correctly rejected permission require different next steps; do not expand access simply to make an error disappear.

Does a registry entry establish that a server is safe?

No. An entry describes collected declarations. Check permissions, provenance and behavior in your own environment.

Is a locally started server automatically isolated?

No. Its actual process permissions and runtime environment determine access.

Is client approval sufficient?

It is an additional control. Also restrict the account, data source and exposed operations.

When should I repeat the checks?

After changing the account, permissions, server version, configuration or data sources.

1. MCP security best practices
   Show retrieval command

   curl -s https://modelcontextprotocol.io/docs/2025-11-25/tutorials/security/security_best_practices
2. MCP tools
   Show retrieval command

   curl -s https://modelcontextprotocol.io/specification/2025-11-25/server/tools
3. VS Code MCP servers
   Show retrieval command

   curl -s https://code.visualstudio.com/docs/agent-customization/mcp-servers

All posts