MCP security for MSPs
MCP security checklist for MSPs
Use these 15 checks before an AI client can reach PSA, RMM, security, documentation, backup, or Microsoft 365 systems across customer tenants.
What should an MSP require from an MCP server?
An MSP should require resource-bound authorization, strict customer-workspace isolation, separately owned provider credentials, least-privilege tool grants, explicit controls for write actions, bounded reads, safe outbound networking, revocation, and useful audit evidence. OAuth alone does not establish those controls.
This checklist is an evaluation framework, not a certification. Ask a vendor to demonstrate each control in the execution path, not only describe it in metadata or a sales document.
15 controls to verify
- Identity and audience. Require authentication for remote MCP, bind tokens to the intended MCP resource, and reject tokens issued for another service.
- No token passthrough. Do not accept a client token and forward it unchanged to an upstream provider. Resolve a separately authorized provider credential.
- Tenant selection. Resolve every request to one explicit MSP or customer workspace. Never infer a customer only from tool arguments.
- Credential ownership. Bind each saved credential to its owner and workspace; recheck that binding when a tool executes.
- Least-privilege catalog. Expose only approved operations required for the workflow, not an entire provider API by default.
- Tool grants. Apply server-side service and tool authorization after discovery and again at execution time.
- Write-action controls. Classify create, update, send, execute, revoke, and delete operations separately from reads.
- Exact confirmation. For higher-impact actions, confirm the actual arguments that will execute rather than a generic approval.
- Bounded reads. Set page sizes, stable sorting, time ranges, and continuation paths so a request cannot silently retrieve an unbounded tenant dataset.
- Outbound request safety. Validate provider destinations and block private, loopback, metadata, and unapproved redirect targets.
- Untrusted content handling. Treat ticket text, documents, tool descriptions, and tool results as data that may contain prompt injection.
- Auditability. Record the actor, workspace, tool, outcome, action type, and timing without putting secrets or returned app data into routine logs.
- Revocation and rotation. Be able to revoke an MCP session, API key, user grant, connection, and upstream credential independently.
- Failure isolation. A failed provider, customer tenant, or tool call should not leak data or authorization state into another request.
- Incident procedure. Document contacts, containment steps, credential rotation, evidence retention, customer notification, and recovery testing.
What evidence should a buyer request?
| Control | Useful evidence |
|---|---|
| Tenant isolation | A negative test showing a valid user cannot select or infer another customer workspace. |
| Authorization | A denied execution after a tool is removed from a grant, even if the client cached its schema. |
| Write safety | A demonstration that changing an argument invalidates the previous confirmation. |
| Data handling | Log fields, retention periods, deletion behavior, and confirmation that ordinary provider bodies are not routinely persisted. |
| Revocation | Measured time from revoking a user, key, grant, or connection to enforcement. |
How Stackyapper maps to the checklist
Stackyapper keeps provider credentials behind its remote MCP endpoint and rechecks identity, workspace, service, tool, risk, and confirmation policy before execution. Its security and access-control page documents the implemented controls, retention, infrastructure, and shared-responsibility boundary. This page does not claim that any gateway can eliminate prompt injection or compromised-identity risk.
Primary security references
- Model Context Protocol authorization specification
- Model Context Protocol security best practices
- OWASP MCP Security Cheat Sheet
- OWASP: MCP Tool Poisoning
Evaluate the operating model
For a general business evaluation, start with the business access-control checklist. Then compare gateways, direct servers, and workflow automation, browse the app catalog, or review MCP for MSPs.