# MCP Security and Governance Readiness Checklist

Use this checklist before approving an MCP server for a production agent workflow. A "no" in any red-flag row should block production deployment until the control exists.

| Control | Question | Evidence required | Status |
|---|---|---|---|
| Ownership | Is there a named technical owner and business owner for this server? | Registry entry with escalation contact | [ ] |
| Purpose | Is the server's purpose limited to a defined workflow? | One-sentence purpose and permitted-agent list | [ ] |
| Inventory | Are all exposed tools, inputs and target systems documented? | Tool manifest and target-system inventory | [ ] |
| Identity | Does every tool call carry an attributable user or workload identity? | Identity design and sample audit record | [ ] |
| Scope | Is each tool granted the minimum action and data scope? | Scope policy and negative test | [ ] |
| Approval | Are irreversible actions behind a human approval gate? | Approval matrix and tested prompt | [ ] |
| Environment | Are production and non-production targets separated? | Environment policy and configuration proof | [ ] |
| Supply chain | Are releases version-pinned, reviewed and dependency-scanned? | Version manifest, scan result, release approval | [ ] |
| Data | Is sensitive data classified, minimised and redacted before model context? | Data-flow diagram and retrieval policy | [ ] |
| Tool integrity | Are tool names and descriptions controlled and reviewed? | Change-control record | [ ] |
| Rate and cost | Are rate limits, retry limits and per-task budgets enforced outside the agent? | Gateway policy and failure test | [ ] |
| Logging | Can an investigator reconstruct the user, prompt, tool, parameters, result and policy decision? | Correlated trace example | [ ] |
| Kill switch | Can an owner disable the server or revoke its access immediately? | Tested revocation procedure | [ ] |
| Vulnerability management | Is the server included in the normal patch and vulnerability process? | Asset record and patch owner | [ ] |
| Review cadence | Is access and server inventory reviewed on a defined schedule? | Calendar owner and last review record | [ ] |

## Approval matrix

| Action class | Default approval rule |
|---|---|
| Read-only retrieval or classification | Autonomous within approved data boundary |
| Reversible internal update | Autonomous only with durable logs, limits and rollback |
| External communication or customer-record change | Human approval per action or formally approved batch |
| Payment, deletion, privileged access or production change | Human approval plus independent system-side control |

> A checklist is not a compensating control. It records whether the real control exists.

Source: [MCP Security and Governance: The Control Map Enterprises Actually Need](/writing/mcp-security-governance/)