Shelf Watch #3: What good looks like on a hosted enterprise MCP server
Originally published in the mcp-ship-check repo, home of the free, offline scanner this post describes. Update (2026-11-11). Since this post first ran, we've finished a static code audit of 300 MCP servers : 10 had a verified code-level vulnerability. One is fixed and published ( atlas-mcp-server , GHSA-w3gh-28jp-2hmv ); the rest are being disclosed privately to their maintainers, and we name a…
The Shelf Watch #3 report outlines best practices for securing hosted enterprise MCP servers, especially those serving multiple tenants. The key findings include four essential controls for a well-guarded server:
1. Login scopes mirroring existing product roles. Clients authenticate using OAuth 2.1 and PKCE, with token scopes mapping to the product's role-based access. This ensures the token only grants the permissions the user already has, preventing over-sharing.
2. Small blast radius by default. Requests per token are capped, typically at 100 per minute. Each call targets a single resource with write tools scoped to a single subject like a device or user. Default validation checks prevent unintentional broad actions.
3. Human approval on every write. Write tools pause for synchronous, in-chat human approval before execution. If approval cannot be obtained, the request fails closed instead of proceeding blindly. Tools should be marked with read/write hints to guide this process.
4. Sensitive tools off the external surface. Money, entitlements, billing, and similar critical functions are not exposed to external MCP clients. These operations remain on internal surfaces accessible only to the vendor's own tools and UI.
The report emphasizes that these controls can be implemented by a small team within a two-person capacity, using existing infrastructure and tools without requiring an enterprise budget. By applying these practices, hosted MCP servers can achieve a higher level of security and prevent unauthorized actions that could compromise multiple tenants.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
