MCP Server Security Checklist for ERP Access

0%

0 of 37 items complete

14 critical items still open - these are the highest-risk gaps.

Download checklist:

Authentication and identity

Remote servers require authentication (for example OAuth 2.x) and do not accept anonymous connectionsCRITICALEach call is tied to a real end user identity, not only a shared service accountCRITICALTokens are short lived and scoped to the minimum neededLocal servers run under a dedicated low privilege OS accountTransport uses TLS for any non-local connectionCRITICALUnused or test clients are revoked and reviewed regularly

Authorization and least privilege

The ERP account used by the server has only the roles required by the exposed toolsCRITICALUser permissions in the ERP are enforced per request, not bypassed by a super userCRITICALDefault tools are read-only; write tools are listed separately and reviewedWrites create drafts or require human approval before postingCRITICALTools return only the fields needed, with sensitive columns masked or excludedRow limits and maximum page sizes are enforced on the serverExport controlled and personal data are excluded or gated by policyCRITICAL

Input handling and injection

All tool arguments are validated against a schema on the server, not only by the modelCRITICALQueries use parameters; no model text is concatenated into SQL or filtersCRITICALFree text from ERP fields is treated as untrusted data, never as instructionsCRITICALTool descriptions come from your own code and are version controlledThird party MCP servers are reviewed before use and pinned to a versionTools cannot call other tools or URLs outside an allow listOutbound network access from the server is restricted by firewall rules

Secrets and configuration

No credentials are hard coded or committed to source controlCRITICALSecrets live in a vault or protected environment variables, with rotationConfiguration files with tokens have restricted file permissionsSeparate credentials exist for development, test and productionError messages do not return stack traces, connection strings or internal paths

Logging, monitoring and response

Every tool call is logged with user, tool, arguments, result size and timeCRITICALLogs avoid storing full sensitive payloads and are protected from tamperingAlerts exist for unusual volume, repeated failures or access to restricted toolsRate limits and per-user quotas protect the ERP from runaway loopsThere is a documented way to disable a tool or revoke a client quicklyCRITICALIncidents involving the server follow your normal security incident process

Deployment and governance

A named owner and a data classification exist for each exposed toolCRITICALThe server runs in a hardened container or host with patched dependenciesDependencies are scanned and updated on a scheduleTests cover permission denial, malformed input and injection attemptsModel hosting and data residency meet your contractual and regulatory dutiesUsers are told what the tools can access and what is logged

Items marked critical should be complete before any production data is exposed. Aim for every critical item plus at least 80 percent of the rest.

Independent MCP security review

Optional: we can review your server design, roles and logging against this checklist.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Walk each group with the people who own the ERP, the identity system and the network. Tick items only when you can show evidence, such as a configuration, a test result or a log sample. Critical items are the ones whose absence can lead to data exposure or unauthorized changes, so treat them as gates for production. Export the finished list to PDF for your change record or audit file.

Review with ERP admin, security and the tool owner together
Attach evidence to each ticked item
Repeat after adding any write tool

The main threats

Four risks dominate. First, over broad access: a server that logs in as an administrator can expose everything. Second, prompt injection: text stored in an ERP comment or a supplier email can contain instructions that steer the model into calling tools. Third, unsafe arguments: unvalidated input reaching a query. Fourth, weak visibility: without call logs you cannot investigate or prove what happened. The controls here address each in turn.

Reading the results

A score below 60 percent or any missing critical item means the server is not ready for production data and should be limited to test records. Between 60 and 80 percent suggests a pilot with read-only tools and close monitoring. Above 80 percent with all critical items is a reasonable baseline, though not a guarantee, since new attack techniques and your own ERP quirks need ongoing review.

Common mistakes

Frequent misses are relying on the model to refuse bad requests, using one shared token for every user, exposing a generic query tool, trusting community servers without reading the code, and keeping no record of calls. Also avoid assuming that on-prem hosting alone makes the system safe: a local model can still be manipulated through data.

Frequently Asked Questions

Why is prompt injection relevant to an ERP?

ERP fields such as notes, descriptions and attachments hold text written by many people and outside parties. If a model reads that text as instructions, it may call tools it should not. Treat all such content as untrusted data.

Is read-only access enough protection?

It limits damage but not exposure. A read tool can still leak pricing, personal data or controlled technical data. Combine read-only tools with field masking, user level permissions and logging.

Should the server use the user's own ERP permissions?

Preferably yes. Passing the user identity so the ERP enforces that user's roles prevents the model from reaching more than the person could. A single shared account usually grants too much.

Does running models on-prem remove the need for this?

No. On-prem hosting addresses data leaving your network, but the access, injection, logging and secrets controls still apply, because the risk is what the server is allowed to do.

Netray designs and reviews private, on-prem MCP and agent setups for ERP data. If you want an independent review against this list, ask us.

Talk to an Expert Explore More Free Tools

Related Tools

AI Agents & Automation

More AI Agents & Automation tools

See all