registry

Least-privilege permissions

• Grant MCP servers only the minimum API keys/credentials required; avoid sharing master keys or admin tokens
• Use scoped credentials (e.g., read-only API keys, restricted IAM roles) and rotate them regularly
• Review permission requests before adding servers; deny overly broad scopes that don't match declared functionality
• Implement credential vaults (e.g., HashiCorp Vault, AWS Secrets Manager) to centralize and audit access

Network isolation

• Run untrusted MCP servers in containerized or sandboxed environments with restricted outbound network access
• Use firewall rules to limit egress to only necessary third-party APIs; block unexpected domains
• Disable or restrict access to internal services, metadata endpoints (e.g., cloud provider IMDSv2), and localhost services
• Implement network segmentation so compromised servers cannot pivot to other infrastructure

Monitoring

• Log all API calls, credential usage, and data transfers from MCP servers; alert on anomalies (e.g., large exfiltration, unexpected destinations)
• Monitor for suspicious behavior: repeated failed auth attempts, access outside declared scope, or timing anomalies
• Review server logs for prompt injection attempts, encoding evasion, or shell metacharacters
• Audit registry entries periodically for repository status, commit history, and maintenance frequency

Red flags to watch for

• Servers with no recent commits, inactive maintainers, or dependencies on archived/deprecated libraries
• Requests for credentials with unnecessarily broad permissions (e.g., admin access for read-only tasks)
• Servers that communicate with undisclosed third-party domains or obfuscate their network behavior
• Vague or missing documentation about data handling, poor code quality, or no security contact information