MCP security checklist for 2026
A checklist for MCP server authors, mapped to OWASP MCP Top 10 and to the checks that verify each item: authentication, transport, tool metadata, tool code, supply chain and governance.
Checklist · OWASP MCP Top 10
Blog
MCP security, with the payloads and the fixes.
Written from the specification, the published research and what the scanner checks. Every claim links to its source.
Tool-description poisoning, explained with the actual payloads
What a poisoned MCP tool description looks like, why the tool never has to be called, how rug pulls and cross-server shadowing work, and how to detect them without drowning in false positives.
Tool poisoning · MCP03
How to add OAuth to an MCP server the way the spec expects
Protected-resource metadata, the WWW-Authenticate challenge, PKCE, audience validation and no token passthrough: the MCP authorization spec, step by step, with code and tests.
Authorization · MCP07