Connecting is the exposure: a 7-point vetting checklist for MCP servers
morphAB · reddit · 2026-08-19
An authorization engineer at Cerbos highlights a common blind spot: most teams can't list which MCP servers are wired into their systems, who owns each, or what they can reach — and you can get burned without ever calling a tool. Trail of Bits showed a malicious server can stuff instructions into tool descriptions, which land in the model's context the moment the client loads the tool list. Combine that with over-scoped long-lived credentials and untrusted input, and you get the GitHub MCP findings from Invariant Labs and Asana's cross-tenant exposure.
They published a vetting checklist for third-party servers covering 7 areas:
- Inventory and ownership;
- Distinct identities per server/agent with least privilege;
- Actually read the tool descriptions;
- An authz check outside the server;
- Know downstream reach;
- Keep audit evidence;
- Narrow or cut access without a redeploy.
The author caveats that a checklist enforces nothing by itself — the controls worth having are the ones that don't rely on trusting the server. Checklist: https://www.cerbos.dev/blog/mcp-server-vetting-checklist
More from coding & agent
- Grok Bot Ran a 12-Hour Data Analysis Nonstop, Handling API Rate Limits Itself — Daniel_Farinax · 2026-10-16
- Apple code signing drags for hours; official advice: just wait a week — pjausovec · 2026-10-16
- Hermes: a 4B model with 8K context got worse with more test-time compute, pointing to contextual reasoning — mangahomanga · 2026-10-16
- Flux 3 Klein's Default Templates Are Broken Without Its Prompt Upscaler — StrictMove5839 · 2026-10-16
- 21-person team ships hundreds of PRs weekly with AI writing 97% of the code — rseroter · 2026-10-16
- ClosedMCP: Set Up MCP Servers Once, Share Them Across Your Whole Team — Ok_Sprinkles1301 · 2026-10-16