MCP and tools
MCP server security review that clears InfoSec
An MCP server is a permissioned adapter, not a chatbot plugin. Here is the security review we run before Claude gets hands on Salesforce, SAP, or your internal APIs.
June 1, 2026/2 min read/Claude Certified Engineers
An MCP server is the process that turns Claude's tool call into a real side effect. Security review is about that process: who it authenticates as, what it is allowed to do, and what you can prove after the fact. The Model Context Protocol is transport. It does not make a catch-all Salesforce wrapper safe.
This is the work we do on MCP and Tool Integration before anything faces production traffic.
The review list we actually run
- Identity. Constrained service account, not a copied admin session.
- Scope. Named verbs from the tool schema design, not
method+path+body. - Validation. Same JSON Schema on both sides. Failed args return
error_code, not a stack trace. - Logging. Principal, tool, record ids, timestamp. Payloads redacted if they can hold PII.
- Idempotency on create and update. Agents retry. Double charges are a schema problem.
- Environment. Staging tools do not ship to production by renaming a URL.
- Injection. Tool results and document fields are data. See prompt injection.
If any item is a slide instead of a control, the review fails.
What InfoSec wants to read
A package they can attach to a ticket:
- Data flow diagram with the MCP server as a box, not a vibe.
- Permission matrix per tool.
- Retention and redaction rules for traces.
- The eval cases that prove refused exports and missing-field behavior.
We hand that package over on regulated work (HIPAA, SOC 2, privilege-aware legal). If your current server is a weekend plugin, start with the review, not with more tools.
Questions
- What should an MCP security review cover?
- Identity, scope, schema validation, logging, idempotency, environment splits, and whether irreversible tools exist at all. "We used HTTPS" is not a review.
- Why do security teams reject MCP demos?
- The demo usually runs as an admin, exposes a catch-all REST tool, and has no audit trail. That is a remote shell with a friendly name.
- Can staging and production share an MCP server?
- No. Staging may have delete tools. Production should not, or those tools should require a change ticket only a human can mint.