Document an MCP server for a security reviewer

A reviewer needs the exposed capability and trust boundaries, not only installation steps. Document what the server can access, how authority flows and what tests support the controls.

Check a complete review record

The MCP contract lab builds an authored document.

from mcp_cases import security_review_case

result = security_review_case()
assert result["complete"] is True
assert result["approved"] is False
assert result["server_executed"] is False
assert result["document"]["writes"] == "none"
assert result["document"]["reviewer"] == "pending"

Complete fields do not mean approval or a running server.

Cover the trust model

Describe purpose, deployment, hosts, tools/resources/prompts, schemas, identities/delegation, credential storage, data classes/flows, access, writes/approvals, rate limits, logs/retention, dependencies and network boundaries.

Threats should include prompt injection, cross-tenant access, confused deputy/token passthrough, schema drift, secret leakage, excessive calls and supply-chain issues. Link contract, isolation, failure and adversarial tests plus unresolved findings.

Make review reproducible

Pin code/dependency/config versions, provide local run/test commands, architecture/data-flow diagrams and an inventory of external services. Separate automated results, reviewer comments and approval status. Define incident owner, rollback and reevaluation triggers.

The Generative & Agentic AI course uses this as the MCP deliverable’s evidence index.

Exercise

Write the package for a read-only server and conduct a mock review. Repair every unanswered trust-boundary question while keeping approval pending until authorized review.

Continue learning

This article is part of the MCP and integration contracts sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the preceding task in Detect schema drift in a third-party integration.
• Return to the cluster foundation in MCP tools, resources and prompts: assign the right responsibility.

References: MCP security best practices and OWASP Agentic Security Initiative.