MCP security checklist: 9 checks before you connect a server

A practical checklist for connecting MCP servers to real business data without regrets.

The checklist

1. Who published it? Prefer a ✓ verified domain that matches the app (for example, an official Stripe server from stripe.com).
2. Is it live and stable? Check the health bars and 7-day uptime on its page.
3. What tools does it expose? Read the verified tool list. Anything labeled can modify can change or delete data.
4. Is there a read-only mode? If you only need answers, connect only read-only tools.
5. OAuth over API keys. OAuth gives scoped, revocable access.
6. Scope the key. If you must use a key, create one with the fewest permissions.
7. Is the code public? A public repo with a real license is a good sign.
8. Is it maintained? Look at "Updated" and the change history. Abandoned servers break quietly.
9. Watch for tool changes. A server that silently adds a delete_all tool is exactly what alerts are for.

Our score rolls most of these into one number, and the method is fully public. It's a starting point, not a security audit.