MCP Server Security Checklist for ERP Access
An MCP server is a doorway between a language model and your ERP. Whatever the server can do, the model can be tricked into attempting. This checklist covers the controls that matter before you connect real data.
0 of 37 items complete
14 critical items still open - these are the highest-risk gaps.
Authentication and identity
Authorization and least privilege
Input handling and injection
Secrets and configuration
Logging, monitoring and response
Deployment and governance
Items marked critical should be complete before any production data is exposed. Aim for every critical item plus at least 80 percent of the rest.
Independent MCP security review
Optional: we can review your server design, roles and logging against this checklist.
Optional. The tool and every export work without this. No spam.
How to use the checklist
Walk each group with the people who own the ERP, the identity system and the network. Tick items only when you can show evidence, such as a configuration, a test result or a log sample. Critical items are the ones whose absence can lead to data exposure or unauthorized changes, so treat them as gates for production. Export the finished list to PDF for your change record or audit file.
- Review with ERP admin, security and the tool owner together
- Attach evidence to each ticked item
- Repeat after adding any write tool
The main threats
Four risks dominate. First, over broad access: a server that logs in as an administrator can expose everything. Second, prompt injection: text stored in an ERP comment or a supplier email can contain instructions that steer the model into calling tools. Third, unsafe arguments: unvalidated input reaching a query. Fourth, weak visibility: without call logs you cannot investigate or prove what happened. The controls here address each in turn.
Reading the results
A score below 60 percent or any missing critical item means the server is not ready for production data and should be limited to test records. Between 60 and 80 percent suggests a pilot with read-only tools and close monitoring. Above 80 percent with all critical items is a reasonable baseline, though not a guarantee, since new attack techniques and your own ERP quirks need ongoing review.
Common mistakes
Frequent misses are relying on the model to refuse bad requests, using one shared token for every user, exposing a generic query tool, trusting community servers without reading the code, and keeping no record of calls. Also avoid assuming that on-prem hosting alone makes the system safe: a local model can still be manipulated through data.
Frequently Asked Questions
Why is prompt injection relevant to an ERP?
ERP fields such as notes, descriptions and attachments hold text written by many people and outside parties. If a model reads that text as instructions, it may call tools it should not. Treat all such content as untrusted data.
Is read-only access enough protection?
It limits damage but not exposure. A read tool can still leak pricing, personal data or controlled technical data. Combine read-only tools with field masking, user level permissions and logging.
Should the server use the user's own ERP permissions?
Preferably yes. Passing the user identity so the ERP enforces that user's roles prevents the model from reaching more than the person could. A single shared account usually grants too much.
Does running models on-prem remove the need for this?
No. On-prem hosting addresses data leaving your network, but the access, injection, logging and secrets controls still apply, because the risk is what the server is allowed to do.
Netray designs and reviews private, on-prem MCP and agent setups for ERP data. If you want an independent review against this list, ask us.
Related Tools
AI Agent Tool Permission Worksheet
Inventory each agent tool, score its blast radius and decide who approves it before an AI agent touches ERP data.
Developer ToolsMCP Tool Catalog and Risk Worksheet
Register each MCP tool your agent exposes, the ERP object it touches and a computed risk score, then export to Excel.
Developer ToolsMCP Server Deployment Runbook Template
A fill-in runbook covering host, secrets, network, health checks, monitoring and rollback for an MCP server in front of an ERP.
Developer ToolsClaude Desktop MCP Config JSON Generator
Build the mcpServers entry for claude_desktop_config.json with the right command, arguments and environment variables.
More AI Agents & Automation tools
See all- Business Process Automation ROI Calculator
- AI Agent Use Case Prioritizer
- Document Processing Automation Savings Calculator
- AP Invoice Automation ROI Calculator
- Order Entry Automation Savings Calculator
- Quote-to-Cash Cycle Time Calculator
- Manufacturing AI Readiness Assessment
- RPA vs AI Agent Selector
- ERP AI Maturity Assessment
Keep exploring
Free tools
- MCP Server Deployment Runbook TemplateA fill-in runbook covering host, secrets, network, health checks, monitoring and rollback for an MCP server in front of an ERP.
- AI Agent Security Review ChecklistA 30-point security review for AI agents that can call tools and write to business systems, covering identity, permissions, prompt injection, data handling, and audit.
- MCP Integration Effort EstimatorEstimate the engineering hours and cost to build MCP servers connecting AI agents to your enterprise systems, based on system count, integration complexity, and auth model.
ERP fixes and how-tos
- How to Securely Give an LLM Access to ERP DataHow a CTO can give an LLM access to ERP data safely: read-only roles, per-user permissions, prompt injection defenses, logging, and where the model runs.
- Private AI Layer for SyteLine On-Prem: Reference ArchitectureReference architecture to add a private AI assistant to SyteLine on-prem: data access paths, retrieval, permissions, sizing and rollout, no cloud needed.
- Adding a Private AI Layer to Dynamics GP On-PremAdd AI to Dynamics GP on-prem without cloud: curated SQL views, eConnect for writes, retrieval index, local LLM, mirrored GP security, approved write-back.
Guides
- Security Review Checklist for Enterprise AI AgentsA security review checklist for enterprise AI agents: data residency, identity and access, prompt injection defense, logging, and vendor risk for manufacturers.
- Prompt Injection Defense: An Enterprise ArchitecturePrompt injection defense architecture for enterprise AI: input and output filtering, least-privilege tool access, and human approval gates.
- MCP Enterprise Integration: Servers, Auth, and Tool GovernanceA practical guide to enterprise MCP integration: server architecture, authentication, and governing which tools an AI agent is allowed to call.
Integrations
- How to build an MCP server for Infor LNHow to build a Model Context Protocol server for Infor LN: which read-only tools to expose, auth through ION API, stdio versus HTTP, permission scoping and audit.
- How to build an MCP server for KatanaHow to build a Model Context Protocol server for Katana: tools to expose, API key handling, stdio versus HTTP transport, rate limits, scoping and audit logging.