An MCP server lets an AI assistant call a vendor's security tool as a set of actions. Before connecting one, ask how it authenticates, which actions it exposes, what data comes back, whether calls are logged, and whether write actions can be switched off. Start read only.
Definitions
The Model Context Protocol (MCP) is a standard way for AI assistants to use outside tools. An MCP server is the piece a vendor runs or ships that exposes those tools. A scope is a limit on what a connection may do, such as read findings but not change policies. A guardrail is a rule that stops or flags risky calls before they run.
Why this needs more care than a normal integration
A normal API call is written by a developer who reads the documentation. An assistant chooses calls on its own, based on text it reads, including text from files and web pages it was never meant to trust. That makes scopes and logging more important, not less. See can an AI assistant use a security scanner through MCP for the basics.
Questions to ask
| Question | What you want |
|---|---|
| How does it authenticate? | Scoped tokens or standard sign-in, not a shared secret in a config file |
| Which tools does it expose? | A documented list with read versus write marked |
| Can write actions be disabled? | Yes, per connection |
| What data is returned to the assistant? | Findings and metadata, with no secrets or full source unless needed |
| Are calls logged with who, what and when? | Entries you can export |
| Is there a rate limit? | Stated numbers |
| Where does it run? | Local process, remote service, or both |
| How is the server package or endpoint verified? | Signed releases, clear publisher |
Package verification deserves its own question. Treat an MCP server like any dependency you install. See whether the official MCP registry vets servers.
Setup steps to follow
- Create a dedicated, minimal account for the connection.
- Grant read only scopes first.
- Connect from one developer machine and run a few real questions.
- Review the logs to see exactly which calls the assistant made.
- Add write actions only for a defined task and review them afterwards.
- Write down who owns the connection and when its token expires.
What to watch for
Output from a tool can contain text that tries to steer the assistant, for example a finding description crafted by an attacker. Ask whether the vendor sanitises or labels such content, and whether the server enforces its own limits regardless of what the assistant requests. The server should be the control, not the model's good behaviour.
Try it yourself
Click through it at your own pace, or open it full screen.
Walk through the setup and note each point where you could narrow the scope.
Quick check
Is an MCP server safe to connect to a coding assistant?
It can be, with narrow scopes, logging and read only defaults. Treat it like granting access to any new service account.
Do we need approval from security first?
Yes, if the server can read findings or change settings. Ask the vendor for the tool list so review is quick.
Safeguard offers an MCP Guardrail and agent identity as GA capabilities; try the free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
