Connecting is the exposure: a 7-point vetting checklist for MCP servers
morphAB · reddit · 2026-08-19
An authorization engineer at Cerbos highlights a common blind spot: most teams can't list which MCP servers are wired into their systems, who owns each, or what they can reach — and you can get burned without ever calling a tool. Trail of Bits showed a malicious server can stuff instructions into tool descriptions, which land in the model's context the moment the client loads the tool list. Combine that with over-scoped long-lived credentials and untrusted input, and you get the GitHub MCP findings from Invariant Labs and Asana's cross-tenant exposure.
They published a vetting checklist for third-party servers covering 7 areas:
- Inventory and ownership;
- Distinct identities per server/agent with least privilege;
- Actually read the tool descriptions;
- An authz check outside the server;
- Know downstream reach;
- Keep audit evidence;
- Narrow or cut access without a redeploy.
The author caveats that a checklist enforces nothing by itself — the controls worth having are the ones that don't rely on trusting the server. Checklist: https://www.cerbos.dev/blog/mcp-server-vetting-checklist
More from coding & agent
- Sub8 enables local Linux automation controlled by Claude or local models — Daniel_Farinax · 2026-08-19
- Always-on AI Agents need background updates without restarts, hitting OS-level limits — koltregaskes · 2026-08-19
- Open Source MemMachine: Universal Memory Layer for AI Agents — tom_doerr · 2026-08-19
- Rust Web Framework Earendil Hits Hacker News Front Page — mitsuhiko · 2026-08-19
- Fix Hallucinations with Local Wikipedia, Not Bigger Models — PieBru · 2026-08-19
- Yeku: An MCP Server to Deploy Full Apps in One Message — itsAg3nt47 · 2026-08-19