# MCP connector security review and test record

Proposed worksheet, not a completed assessment. Use synthetic records and authorised non-production accounts. Keep secrets and confidential payloads out of this file.

Connector/version: [value]. Transport: [stdio/HTTP]. Host/model: [value]. Process owner: [role]. Application/security reviewers: [roles]. Date: [date]. Permitted task: [named read operation].

## Configuration review

- [ ] Pin executable/dependency revisions; record update and disable procedures.
- [ ] Record process account, inherited environment, readable/writable paths and outbound destinations.
- [ ] Derive caller identity from verified authentication, never a model argument.
- [ ] For HTTP, check token issuer, expiry and intended audience using the applicable specification. Keep downstream credentials separate; prohibit token passthrough.
- [ ] For stdio, review launcher and environment credentials; HTTP token checks are not a substitute.
- [ ] Authorise each operation and record; constrain identifiers, result size, time and retries.
- [ ] Keep arbitrary SQL, shell and unrestricted destination URLs outside this read-only pilot.
- [ ] Restrict logs to required metadata, with retention and incident access agreed.

## Test cases to execute

| Case | Expected | Actual decision/content inspected | Evidence/date | Owner/result |
| --- | --- | --- | --- | --- |
| User A reads A's synthetic record | Allow only permitted fields | Not run | Not run | Unassigned |
| User B asks for A's record | Deny; no restricted text or title | Not run | Not run | Unassigned |
| Caller supplies another user's identity | Ignore/reject spoofed authority | Not run | Not run | Unassigned |
| Missing/expired/wrong-audience HTTP token | Deny before application data release | Not run | Not run | Unassigned |
| Retrieved document requests forbidden export | Tool rejects operation regardless of model output | Not run | Not run | Unassigned |
| Unexpected tool/argument or oversize request | Reject under the server contract | Not run | Not run | Unassigned |
| Access revoked or permission check unavailable | Deny; never retry with broader credential | Not run | Not run | Unassigned |
| Disable connector and revoke credential | Connector stops; manual application remains usable | Not run | Not run | Unassigned |

Inspect direct calls and assistant-mediated calls. Record prompt/model/connector revisions. Passing finite cases is not proof against every attack. Compare local and hosted configurations using the same cases and entitlements; record changed processing destinations separately.

Decision: [accept limited pilot/change/stop]. Unresolved failures: [list]. Review after connector, model, identity or permission changes.