# MCP Server Security Checklist for ERP Access > Source: https://netray.co/tools/mcp-server-security-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Work through authentication, authorization, input handling, prompt injection, secrets, logging and deployment before an MCP server touches ERP data. ## Category ai-automation ## Audience - IT security - ERP administrator - AI engineer - CISO ## Tool **Kind:** checklist **Scoring Note:** Items marked critical should be complete before any production data is exposed. Aim for every critical item plus at least 80 percent of the rest. **Groups:** #### Authentication and identity **Items:** **Text:** Remote servers require authentication (for example OAuth 2.x) and do not accept anonymous connections **Critical:** true **Text:** Each call is tied to a real end user identity, not only a shared service account **Critical:** true Tokens are short lived and scoped to the minimum needed Local servers run under a dedicated low privilege OS account **Text:** Transport uses TLS for any non-local connection **Critical:** true Unused or test clients are revoked and reviewed regularly #### Authorization and least privilege **Items:** **Text:** The ERP account used by the server has only the roles required by the exposed tools **Critical:** true **Text:** User permissions in the ERP are enforced per request, not bypassed by a super user **Critical:** true Default tools are read-only; write tools are listed separately and reviewed **Text:** Writes create drafts or require human approval before posting **Critical:** true Tools return only the fields needed, with sensitive columns masked or excluded Row limits and maximum page sizes are enforced on the server **Text:** Export controlled and personal data are excluded or gated by policy **Critical:** true #### Input handling and injection **Items:** **Text:** All tool arguments are validated against a schema on the server, not only by the model **Critical:** true **Text:** Queries use parameters; no model text is concatenated into SQL or filters **Critical:** true **Text:** Free text from ERP fields is treated as untrusted data, never as instructions **Critical:** true Tool descriptions come from your own code and are version controlled Third party MCP servers are reviewed before use and pinned to a version Tools cannot call other tools or URLs outside an allow list Outbound network access from the server is restricted by firewall rules #### Secrets and configuration **Items:** **Text:** No credentials are hard coded or committed to source control **Critical:** true Secrets live in a vault or protected environment variables, with rotation Configuration files with tokens have restricted file permissions Separate credentials exist for development, test and production Error messages do not return stack traces, connection strings or internal paths #### Logging, monitoring and response **Items:** **Text:** Every tool call is logged with user, tool, arguments, result size and time **Critical:** true Logs avoid storing full sensitive payloads and are protected from tampering Alerts exist for unusual volume, repeated failures or access to restricted tools Rate limits and per-user quotas protect the ERP from runaway loops **Text:** There is a documented way to disable a tool or revoke a client quickly **Critical:** true Incidents involving the server follow your normal security incident process #### Deployment and governance **Items:** **Text:** A named owner and a data classification exist for each exposed tool **Critical:** true The server runs in a hardened container or host with patched dependencies Dependencies are scanned and updated on a schedule Tests cover permission denial, malformed input and injection attempts Model hosting and data residency meet your contractual and regulatory duties Users are told what the tools can access and what is logged ## Content **Intro:** An MCP server is a doorway between a language model and your ERP. Whatever the server can do, the model can be tricked into attempting. This checklist covers the controls that matter before you connect real data. **Sections:** #### How to use the checklist **Body:** Walk each group with the people who own the ERP, the identity system and the network. Tick items only when you can show evidence, such as a configuration, a test result or a log sample. Critical items are the ones whose absence can lead to data exposure or unauthorized changes, so treat them as gates for production. Export the finished list to PDF for your change record or audit file. **Bullets:** - Review with ERP admin, security and the tool owner together - Attach evidence to each ticked item - Repeat after adding any write tool #### The main threats **Body:** Four risks dominate. First, over broad access: a server that logs in as an administrator can expose everything. Second, prompt injection: text stored in an ERP comment or a supplier email can contain instructions that steer the model into calling tools. Third, unsafe arguments: unvalidated input reaching a query. Fourth, weak visibility: without call logs you cannot investigate or prove what happened. The controls here address each in turn. #### Reading the results **Body:** A score below 60 percent or any missing critical item means the server is not ready for production data and should be limited to test records. Between 60 and 80 percent suggests a pilot with read-only tools and close monitoring. Above 80 percent with all critical items is a reasonable baseline, though not a guarantee, since new attack techniques and your own ERP quirks need ongoing review. #### Common mistakes **Body:** Frequent misses are relying on the model to refuse bad requests, using one shared token for every user, exposing a generic query tool, trusting community servers without reading the code, and keeping no record of calls. Also avoid assuming that on-prem hosting alone makes the system safe: a local model can still be manipulated through data. **Cta:** Netray designs and reviews private, on-prem MCP and agent setups for ERP data. If you want an independent review against this list, ask us. **Faq:** #### Why is prompt injection relevant to an ERP? **Answer:** ERP fields such as notes, descriptions and attachments hold text written by many people and outside parties. If a model reads that text as instructions, it may call tools it should not. Treat all such content as untrusted data. #### Is read-only access enough protection? **Answer:** It limits damage but not exposure. A read tool can still leak pricing, personal data or controlled technical data. Combine read-only tools with field masking, user level permissions and logging. #### Should the server use the user's own ERP permissions? **Answer:** Preferably yes. Passing the user identity so the ERP enforces that user's roles prevents the model from reaching more than the person could. A single shared account usually grants too much. #### Does running models on-prem remove the need for this? **Answer:** No. On-prem hosting addresses data leaving your network, but the access, injection, logging and secrets controls still apply, because the risk is what the server is allowed to do. ## Search terms mcp server security checklist, mcp security best practices, secure mcp server erp, prompt injection mcp tools, mcp authentication oauth, ai agent security review, mcp least privilege, mcp audit logging --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json