Separate provider signup from client access
The hosting account and the people using your MCP endpoint are different layers. Minimal hosting signup does not justify a publicly writable tool server. Define which client identities are allowed to call which tools.
Issue narrow credentials
Prefer independently revocable credentials with a limited purpose. Store them privately, rotate them and prevent them from appearing in URLs or logs. Consider a read-only tool set before allowing operations that affect customer resources or money.
Make outcomes visible
Track operation identifiers and statuses. Validate the tool schema, handle cancellation and ensure a retry cannot silently repeat a consequential action. Provide a clear approval path for actions that require one.
Publish only what exists
Check the supported protocol version, endpoint, authentication and limits before connecting a client. A hosted KoalaVPS MCP endpoint and official downloadable package are not currently available.
A minimal account can still have strong access control
Identity minimisation is compatible with scoped API credentials and an authenticated HTTPS endpoint. Keep account recovery and client authorisation distinct. An email address is not the only way to establish an API identity, but the chosen process needs a clear response to lost keys and compromised clients.
A launch acceptance test
Verify TLS, protocol negotiation, schema validation, limited scopes and cancellation. Try a duplicate create request and confirm it resolves to one operation. Reject a request for a resource outside the credential’s boundary. Check that errors and logs do not include the token or private tool inputs.
Official documentation: MCP authorisation
Build a separate identity map for each layer
Document the provider account, payment wallet, MCP client identity, tool-service credential and downstream API account as different principals. Giving them one shared administrative secret makes revocation and attribution harder. Minimal provider signup does not conceal a public endpoint’s IP address, DNS name or outside API usage. Choose which data to minimise at each boundary and explain which records remain necessary.
- Give each client a narrow, revocable access path and name its permitted resources.
- Use separate credentials when the MCP service calls another API; the client’s MCP access token is not a universal downstream token.
- Keep production and experimental workers separate, especially where tools can spend funds or send messages.
- Publish supported versions and a verified endpoint only after they exist. KoalaVPS does not currently operate a public hosted MCP service.
Official documentation: MCP: security best practices
Define a lost-key and revoked-access exercise
Create a disposable client credential, call one permitted read operation, revoke that credential and repeat the call. Verify that any cached permission or application lease respects the revocation policy. Repeat with a resource the client never owned. Preserve outcome records without retaining complete prompts or tool arguments. If an unauthorized call succeeds, stop granting write tools until the server-side resource check is corrected.
- Do not accept a protocol session or request identifier as proof of user identity.
- For HTTP OAuth, test the documented 401/403 behaviour and discovery for the version you actually deploy.
- Reject unknown tool arguments and bound result size, request duration and concurrency.
- Test a retry after a simulated network interruption and verify one consequential operation, not two.
Official documentation: MCP 2026-07-28: HTTP authorization