How to Vet MCP Servers
MCP servers are dependencies with tool access. Vetting them is the security review your agents deserve.
Step 1 — Review the source
Check the repo, author, stars, and maintenance. Pin the version.
Step 2 — Inspect permissions
Does it ask for more access than its job needs? Least privilege.
Step 3 — Find the paid calls
Any tool hitting a paid endpoint? That's a spend surface.
Step 4 — Gate the spend
Add approved servers to the allowlist with caps; everything else is blocked by default.
The decision
APPROVE -> allowlist + caps
CONDITIONAL -> allowlist + reduced caps
REJECT -> not allowlisted (blocked)Vetting becomes enforcement.
FAQ
How long does vetting take?
Minutes per server with the template — most of it is reading the paid calls.
What if a server needs review later?
The approval threshold catches new merchants; the audit log records everything.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check