MCP Server Security: Checks Before You Connect

MCP server security is the set of checks that decide whether a Model Context Protocol server’s tools may act in an AI workspace, for whom, and how far. In Insulin, a third-party MCP server is a personal, OAuth-only connection whose tools the server itself decides, so vet the server first, then narrow it on each agent that uses it.

---

“Before anyone connects a third-party MCP server to our AI workspace, what should we check, and what does the workspace itself control?” A security reviewer asks it before the first server goes in, and the answer comes in two halves. Insulin decides how a server signs in, whose sessions get its tools, how far a custom agent can narrow them and which surfaces ask before a call runs. The server decides what its tools do, what they return and what its sign-in asks for.

This checklist sets both halves side by side from Fours’ documentation: what the product does, not whether a given server is safe.

What is MCP server security?

MCP server security is the set of checks that decide whether a Model Context Protocol server may hand its tools to an AI assistant, whose sessions get them and what they can change. The Model Context Protocol is, in Fours’ words, “an open standard for connecting AI assistants to external tools and data sources.” An MCP server is the far end of that connection: it lists the tools an assistant may call, and it runs them when they’re called.

Connecting one hands three things to someone else: the tool list, since “the available tools depend entirely on the provider”; the sign-in, settled on the server’s own authorization page; and the output, which the model reads whatever it says.

What should you check before you connect an MCP server?

Nine things, in this order: who runs the server, how it signs in, whose sessions get its tools, which tools it brings, how far an agent can narrow them, where a call waits for approval, what its output can carry, how to cut it off, and whether it’s on your approved list. The middle column is what Insulin’s documentation describes; the last is what’s left to you.

Check	What Insulin does	What you check
1. Who runs it	Connects a server from a catalog of pre-configured providers or from any server URL you enter	The operator behind the endpoint and their security documentation; a catalog card doesn’t change who runs it
2. How it signs in	OAuth (PKCE) only: you approve access on the server’s own authorization page, and “a server that offers only client credentials or a static API key can’t be connected”	What that page asks for, and which account approves it, since the connection carries your “personal credentials”
3. Whose sessions get it	Only yours: “MCP server connections are user-level only,” so a server reaches your Insulin assistant and the personal agents you add it to. The only MCP server an organization agent can have is Fours’ own	Who may connect which servers, since each person connects, and signs in to, their own
4. Which tools it brings	Every tool the server exposes, asked for again “each time it starts work.” Only Fours’ own server has an Access choice on its card	The server’s tool list, from the provider, and that it can change between one task and the next
5. How far an agent can narrow it	Read-only or Edit per integration on a custom agent; on Read-only, “a tool Fours does not recognise as a read is treated as a write.” Edit is the default, and the built-in assistant has no such setting	Which agents need the server’s write tools at all
6. Where a call waits for approval	In web chat and a Slack DM, only posting a Slack message waits; a Slack channel @mention doesn’t use servers you connected yourself	That its other write tools run with no one asked first
7. What its output can carry	Each tool call’s output shown inline, with inputs and outputs expandable; no screening of what a tool returns is described	Whether the server returns text other people wrote, which can carry instructions for the model
8. How you cut it off	Disconnect removes the connection and its stored credentials from Fours, but “does not revoke access on the provider side.” One connection per provider	That the grant is revoked in the provider’s own app settings, too
9. Whether it’s approved	Fours’ MCP page describes no organization setting that limits which servers members connect	A published list of approved servers, as Microsoft’s Cloud Adoption Framework recommends

What does an MCP server’s sign-in grant?

Whatever you approve on the server’s own authorization page, under your own account. Fours discovers the server’s OAuth configuration, registers itself as a client and refreshes the token for you, and with OAuth (PKCE) the only method, nobody pastes a shared key into the workspace. What the connection may do is approved on that page: in the documentation’s own example, a Stripe server lets Insulin “look up payments, manage subscriptions, and query billing data on your behalf.”

So read the page before you approve. The MCP specification’s security best practices expect a proxying server’s consent page to “display the specific third-party API scopes being requested,” and list “wildcard or omnibus scopes” among the common mistakes in scope design. A page that names nothing, or asks for everything, is a reason to stop, and a narrower account at the provider makes a narrower connection.

Who can use a third-party MCP server’s tools?

Only the person who connected it, in their own sessions. “MCP server connections are user-level only,” and each user connects their own “with their personal credentials.” That means two places:

• Your Insulin assistant. It “uses allowed user-scope integrations for the current user,” so a server you connect is on offer in your chats with it, on the web and in a Slack DM.
• Your personal agents, if you add it. A personal agent uses only the user-level integrations selected for it, and its Share button is disabled.

Organization agents can’t use one at all. They use “organization-level integrations selected for that agent,” and an MCP server connection is never organization-level. The only MCP server such an agent can have is Fours’ own: an org admin adds it to the agent’s integrations, “where it is listed as Suger MCP,” it “has no Read-only / Edit setting,” and its tools attach only when the person the agent is working for is an organization ADMIN or EDITOR.

The containment cuts both ways: no colleague’s chats reach a server you connect, and nobody can connect one for the whole team, so a review counts connections person by person.

Can you make an MCP server read-only for an agent?

On a custom agent, yes. On the connection itself, only for Fours’ own MCP server. The Access choice on a catalog card, Read only by default, exists for Fours’ server alone: “other MCP servers expose whatever tools they offer,” and their tool list “changes as the provider updates it.”

The narrowing happens on the agent instead, in a select beside each integration in its Integrations list:

Setting	What the agent gets
Read-only	”Use only that integration’s read tools — listing, searching, fetching. Its write tools are removed for this agent, and a tool Fours does not recognise as a read is treated as a write.”
Edit	”Read from the integration and change records there too. This is the default, and it is what an integration selected before the setting existed keeps.”

Three things follow for a reviewer:

1. Read-only fails closed. A tool Fours doesn’t recognise as a read is removed, so an unfamiliar server loses tools rather than keeping them.
2. Existing agents sit on Edit. A server added before the setting existed keeps full access until someone changes it.
3. The assistant is the gap. It has no such setting, so every tool a connected server offers is on offer in your chats with it; only a grant the provider limits to reading narrows that.

Read-only narrows a server you trust; it isn’t a reason to trust one, because what a remaining tool does when called is up to the server that runs it. For integrations whose ceiling is a credential rather than a tool list, where read-only access for AI agents is set goes system by system.

Will an approval card stop an MCP server’s tools?

Don’t count on one. In web chat and a Slack DM, the one call the documentation says waits is posting a Slack message, so a server’s other write tools run as soon as the model calls them. Where the card is, and isn’t, offered:

• Web chat and Slack DMs. The card is offered, but only for posting a message to Slack.
• A Slack channel @mention. The turn “is treated as untrusted,” since everyone in the channel can write what Insulin reads, and anything it “can’t recognize as a read” waits. But that turn “does not use an MCP server you connected yourself.”
• No card at all in an Insulin channel, a Microsoft Teams DM, a reply inside a sub-thread or a job run.

So plan rows 3 and 5 as though nothing will ask first: an agent without a write tool can’t call it on any surface. Where the approval gate is armed maps the card surface by surface.

Can a tool’s output steer the agent?

Yes. Whatever a tool returns enters the conversation, and text in it can be written to instruct the model rather than inform you. That’s indirect prompt injection: an instruction inside content the agent fetched, such as a page, a ticket, a message or a file someone else wrote. Row 7 asks less whether the server is honest than whether its output carries text from people you don’t control.

Insulin shows each call’s output inline, and “tool call details are expandable so you can inspect inputs and outputs.” The documentation describes no screening of what a tool returns, nothing like the Text the AI read line Inbox puts on every HTML email, which how email prompt injection works explains. Microsoft’s guidance is to “treat all incoming data, text, files, and images as potentially hostile,” and the MCP specification’s tools page lists “sanitize tool outputs” among what servers must do, so ask the operator how theirs does it. Then:

• Put readers of outside text on all-Read-only agents. A server that returns other people’s text belongs on a personal agent whose integrations are all Read-only, so an instruction in its output finds no integration it can write to.
• Open the call before you act on it. Expand a tool call and read what it returned before you send, post or approve anything built from it.

How do you remove an MCP server completely?

In two places: disconnect it in Insulin, then revoke Fours’ access in the provider’s own app settings.

1. Disconnect it in Insulin. Under Custom MCP Servers in Settings → Integrations, open the server’s ⋯ menu and choose Disconnect. “This removes the connection and its stored credentials from Fours.”
2. Revoke it at the provider. “This does not revoke access on the provider side. Visit the provider’s app settings to revoke Fours’ access.”
3. Disconnect before you switch accounts. With one connection per provider and no editing, a different account, or a different Access level on Fours’ own server, means disconnecting and adding the server again.
4. Delete a connection that never finished. An authorization times out after five minutes, and a server whose connection didn’t complete shows Delete instead of its ⋯ menu: delete it and add it again.

Step 2 matters because a connection doesn’t wind down on its own: Fours refreshes tokens “automatically before expiry using the refresh token.” Put both steps in offboarding.

What should an approved MCP server list record?

One entry per server, with enough to answer rows 1 to 8 without connecting it again. Microsoft’s Cloud Adoption Framework tells organizations to “restrict external interactions to trusted MCP servers that meet organizational security and compliance standards.” In Insulin that list is a policy rather than a setting, because each member connects their own servers. Record:

• Server and operator: the catalog card or URL, and who runs the endpoint.
• Sign-in: what its authorization page asks for, and which account should approve it.
• Tools: which ones write, and when someone last checked.
• Who may connect it, knowing its write tools reach each connecting member’s assistant chats.
• Agent setting and output: Read-only or Edit on each personal agent, and whether it returns other people’s text.
• Exit: where in the provider’s app settings the grant is revoked.

Frequently asked questions

Can Insulin connect an MCP server that uses an API key?

No. Fours connects to MCP servers with OAuth (PKCE) only, and the server must support OAuth 2.1. A server that offers only client credentials or a static API key can’t be connected.

Who can use an MCP server I connect?

Only you. MCP server connections are user-level only, so a server’s tools reach your own Insulin assistant and any personal agent you add it to. Organization agents can’t use it: the only MCP server they can have is Fours’ own.

Can I make a third-party MCP server read-only?

On a custom agent, yes: set it to Read-only in the agent’s Integrations list, where a tool Fours does not recognise as a read is treated as a write. The built-in Insulin assistant has no such setting, and only Fours’ own server has an Access choice.

Do MCP server tools wait for approval in Insulin?

Don’t count on it. In web chat and a Slack DM, only posting a Slack message waits for approval, so a server’s other write tools run when called. A Slack channel @mention doesn’t use MCP servers you connected yourself.

Does disconnecting an MCP server revoke its access?

Not at the provider. Disconnect removes the connection and its stored credentials from Fours, but it doesn’t revoke access on the provider side. Revoke Fours’ access in the provider’s own app settings as well.

Takeaways

• Vet the server before any setting. Insulin controls how a server signs in, whose sessions get it and how far an agent narrows it; the server controls what its tools do and return.
• A third-party MCP server is personal. It connects with OAuth (PKCE) only and reaches only its owner’s sessions; the only MCP server an organization agent can have is Fours’ own.
• Narrow on the agent, because nothing asks first. Read-only fails closed, Edit is the default, and the built-in assistant has no such setting.
• Treat tool output as untrusted, and keep servers that return other people’s writing on all-Read-only agents.
• Leave in two places: Disconnect in Insulin, then revoke Fours’ access at the provider.

An MCP server is one piece of an agent’s supply chain. To review it beside the other agentic risks, each with the control Insulin’s docs describe, work through the OWASP Agentic Top 10 checklist for an AI workspace.