Answer with a role and a process: who may request a server, who approves it, what checks happen first, and what you do about servers added outside the process. "Anyone can add one" is a legitimate finding only if you pair it with compensating controls and a plan.
Why this is a change control question
Adding an MCP server changes what an assistant can do. It is closer to installing software with network access than to changing a setting. The MCP security guidance says local servers can be installed through a client's configuration flows, and that one-click setups must show the exact command and require explicit approval before running. That puts the first line of control in the client, and the second in your process.
The intake that reviewers like
- Request. A short form: name, source, purpose, local or remote, tools exposed, credential needed.
- Checks. Review the source and maintainer, read the tool list, test in a sandbox, confirm what data it can reach.
- Decision. A named approver records approve, approve with limits, or decline.
- Registration. The server goes into the register with an owner and a review date.
- Rollout. Distribute the approved configuration so people do not hand-write their own.
Step five is the one teams skip. A shared, approved config file makes the right path the easy path.
Three common models
| Model | Strength | Weakness |
|---|---|---|
| Central allowlist | Clear and auditable | Can slow teams down |
| Team level approval | Fast, close to context | Uneven rigor |
| Open with monitoring | No friction | Detection after the fact |
Most organisations land on a mix: an allowlist for servers that touch customer data, team approval for low risk read only tools. Say which applies where. See which MCP servers are low, medium or high risk.
Sample wording
"Engineers may request an MCP server through a short intake. The security team reviews the source, tool list and credentials, tests it in a sandbox and records a decision. Approved servers are distributed through a managed configuration and added to our register. Servers found outside the process are removed and the user is contacted."
If your reality is "we trust people", write: "We rely on engineering judgment and review the register quarterly; a formal intake is planned." That is a better answer than an invented process.
What happens when someone skips the process
Reviewers like this follow up. Describe how you find unapproved servers (repository config scans, endpoint checks, periodic review) and what you do when you find one. Keep it proportionate: education first, removal if it touches sensitive data.
Evidence
The intake form template, one anonymised decision record and the register extract. Safeguard's asset discovery and MCP Guardrail can support finding servers and controlling which tools agents may call.
Quick check
Do read only servers need the same approval?
They need less, not none. A read only server can still read secrets or customer data, so check what it can reach.
Who should approve?
A person who understands the data involved, usually security with the system owner. Name the role, not a committee.
Sources
Last reviewed: 19 October 2026.
