Direct answer
MCP Server Security Checklist
Before you trust an MCP server, check three things: its tool descriptions (what the AI is told the tools do), its scopes (what the tools can actually reach), and its untrusted inputs (what flows into the tools from the outside world). Then scan inputs at runtime with prompt_shield and keep receipts of the review, so the audit itself is a record someone else can check. This page is the checklist, in order.
Updated October 20, 2026.
The risks, in plain terms
An MCP server gives an AI hands. The risks follow from that one fact. A tool description can steer the AI: descriptions are instructions the model reads, and a misleading or loaded description can push calls you never intended. A broad scope turns one bad call into real damage: a tool that can read one file is a nuisance when misused, a tool that can write anywhere, send mail, or spend money is an incident. And untrusted input is the quiet one: tool results, web pages, documents, and messages the server fetches can carry instructions aimed at the AI, not at you, a pattern covered on the prompt injection test tool page.
None of this means avoid MCP servers. It means audit one the way you would audit anything you hand keys to: before it runs, with a list, and on the record.
The checklist
- Read every tool description as the AI will. Does each description say exactly what the tool does, no more? Flag descriptions that urge the AI to prefer this server, hide side effects, or ask for data the tool does not need.
- Map scopes to jobs. For each tool, list what it can read, write, send, and spend. If a scope is broader than the job you bought the server for, that gap is your risk.
- Find every untrusted input. Anything the server fetches or receives, pages, files, feeds, user text, other tools' output, is input an attacker can shape. Mark where each one enters.
- Check the money paths. Any tool that can pay, order, or transfer gets a human approval step and a spend limit, no exceptions for convenience.
- Ask who captures the record. Calls should be receipted by the layer running them, so the history you review later is the history that happened.
- Test with hostile samples. Run the server against text carrying embedded instructions and confirm the AI treats it as data, not orders.
- Re-run the audit when the server changes. New tools, new descriptions, new scopes: the checklist runs again, not just at install.
Runtime scanning with prompt_shield
A checklist is a snapshot; inputs arrive all day. prompt_shield, a tool on the Zambo MCP, scans text at runtime for prompt injection patterns: instructions hidden in documents, pages, and messages that try to redirect the AI. Route untrusted inputs through the scan before the AI acts on them, and treat a flagged input the way you would treat a flagged attachment: read it yourself, decide, and keep the scan result with the work.
The pattern is defense in depth, not a single wall: tight descriptions and scopes limit what a bad input can reach, scanning catches the obvious attacks on the way in, and receipts make the calls reviewable after the fact. The vibe-coded version of the same question is covered on is my vibe-coded app safe.
Receipts for review
An audit nobody can recheck is an opinion. When calls run through the Zambo MCP (https://zambo.dev/mcp, 153 tools total, 35 on the default surface), each call returns a verifiable receipt at a public URL. Keep the receipts from your audit session, the scans, the hostile samples, the calls the server made, and your review stops being a claim: anyone can open the records at zambo.dev/verify and see what actually ran. A Day Pass is $0.99 one time and covers 24 hours. The Zambo Pass is $29 a month or $290 a year, and $19 a month for $ZAMBO holders. Humans pay by PayPal or card through PayPal; agents pay USDC on Base via x402.
Honest limits
This checklist reduces risk; it does not certify any server as safe, and no scan catches every attack. prompt_shield flags known injection patterns in text; novel attacks, and risks that live in a server's code rather than its inputs, are outside what a scan can see. A receipt of an audit proves the audit calls ran as recorded; it does not prove the conclusions were right. For servers that touch money, credentials, or production data, pair this checklist with a real code review by someone who can read the server.
Frequently asked questions
How do I audit an MCP server for security?
Work the checklist in order: read every tool description as the AI will read it, map each tool's scopes against the job you need done, find every untrusted input and where it enters, put human approval and spend limits on money paths, confirm calls are captured as receipts by the layer running them, test with hostile samples carrying embedded instructions, and re-run the whole audit whenever the server changes.
What is the biggest MCP server security risk?
Scope plus untrusted input, together. A tool that can write, send, or spend becomes dangerous the moment text the server fetched, a page, a document, another tool's output, carries instructions the AI follows. Tight scopes limit what a hijacked input can reach, runtime scanning with prompt_shield catches known injection patterns on the way in, and receipts make every call reviewable afterwards.
What does prompt_shield do?
prompt_shield is a Zambo tool that scans text for prompt injection patterns: instructions hidden inside documents, web pages, and messages that try to redirect an AI. Route untrusted inputs through it before the AI acts on them. A flag means read the input yourself before proceeding. It catches known patterns; it is one layer in a defense that also needs tight scopes and reviewable records.
Why keep receipts of a security review?
Because an audit is itself work someone may need to trust. Receipts from the audit session, the scans run, the samples tested, the calls made, sit at public URLs anyone can recheck free at https://zambo.dev/verify/. The review becomes evidence instead of a claim, and when the server updates, the new audit's receipts sit alongside the old ones so the change is visible.
What does an MCP security audit cost with Zambo?
The scanning and receipt tools are part of Zambo, so light audit use fits the free tier. A Day Pass is $0.99 one time for 24 hours, enough to audit a server end to end. The Zambo Pass is $29 a month or $290 a year, and $19 a month for $ZAMBO holders. Checking any receipt is free with no signup. A serious code review by a human expert is a separate cost this page does not replace.