Protocol
Audit an MCP server before giving it repository context
A tool description is part of the agent's instruction and execution surface.
When it fits
- A coding agent wants to connect to a new MCP server or tool package.
When to avoid it
- MCP ecosystems evolve quickly; review the current implementation and vendor security guidance rather than relying on protocol labels alone.
Why it matters
Verify the server's source, operator, permissions, tools, network behavior and update mechanism before connection. Approve only the tools needed for the task, watch for name collisions or changed definitions, and keep repository or credential access narrower than the developer's full account.
Steps
- Server provenance checked.
- Tool list reviewed.
- Permissions scoped.
- Network behavior understood.
- Updates/change detection considered.
- Name collisions checked.
An example
A code-search MCP gets read-only repository access; a server that also offers shell and cloud-admin tools is not connected for the search task.
Check your result
Each connected server and tool has an explicit purpose and bounded permission set.
Keep this limit in mind
- MCP ecosystems evolve quickly; review the current implementation and vendor security guidance rather than relying on protocol labels alone.
Evidence and sources
OWASP's current secure-coding-with-AI guidance treats repository content, issues, PRs, comments, fetched pages, logs and tool responses as potential indirect prompt-injection inputs for coding agents.
Threat likelihood depends on who can influence the content and what permissions the agent has.
Secure Coding with AI Cheat Sheet · Indirect Prompt Injection in the Development Loop