# Local desktop MCP security checklist

Version: 2026-08-26

Use this checklist when a desktop application exposes local capabilities to an
MCP client or another agent bridge. It is a threat-model prompt, not a security
certification or a substitute for an independent review. Copy and adapt it
without attribution.

## 1. Map authority before choosing controls

- [ ] List every tool, resource and prompt exposed to the client.
- [ ] Separate read-only inspection from state-changing and destructive actions.
- [ ] Record which actions read user files, capture media, contact a network or
      write outside the application's project directory.
- [ ] Document what the client can send to a cloud model or third-party service.
- [ ] State which operating-system account, process and permission boundaries
      remain outside the MCP server's control.

## 2. Bind and route narrowly

- [ ] Bind an explicit loopback address rather than an unspecified interface.
- [ ] Reject requests whose remote peer is not loopback.
- [ ] Validate the `Host` header against the expected loopback host and active
      port; do not trust DNS rebinding defenses to CORS alone.
- [ ] Validate browser `Origin` when one is present, and reject unexpected
      cross-origin browser requests.
- [ ] Allow only the required methods, routes and content types.
- [ ] Apply request-header, request-body and read-time limits before parsing.

## 3. Protect credential discovery

- [ ] Generate a high-entropy credential with a cryptographically secure random
      source for every application launch.
- [ ] Use an ephemeral port or otherwise bind discovery state to the current
      application instance.
- [ ] Store discovery material in a per-user location with owner-only
      permissions and re-check permissions after replacement.
- [ ] Include enough process identity to reject a crash-stale discovery record
      or PID reuse.
- [ ] Delete the discovery record during an orderly shutdown and treat a
      surviving record as untrusted until the process identity is verified.
- [ ] Never place the bearer credential in logs, analytics, error text, URLs or
      screenshots.

## 4. Authenticate and isolate requests

- [ ] Require authentication on every MCP request, including initialization and
      benign read-only calls.
- [ ] Return the same external error shape for a missing and an incorrect
      credential where practical.
- [ ] Compare fixed-width credential material without an early-exit byte
      comparison; do not overstate this as proof that the whole request path is
      constant-time.
- [ ] Validate structured input before invoking application code.
- [ ] Limit request concurrency, retained state and tool execution time.
- [ ] Ensure one connected client cannot enumerate or cancel another client's
      long-running work using only a guessable identifier.

## 5. Treat long jobs as capabilities

- [ ] Return a separate high-entropy capability for each background job.
- [ ] Require both the job identifier and its secret capability for status,
      result and cancellation calls.
- [ ] Avoid an existence oracle: an unknown identifier and a wrong capability
      should not reveal different useful information.
- [ ] Bound simultaneous active jobs and retained terminal jobs.
- [ ] Expire completed results and set maximum sizes for progress and result
      payloads.
- [ ] Give every job a maximum runtime or document why a human must stop it.

## 6. Reuse the application's human safety gates

- [ ] Route agent mutations through the same validation, undo history,
      autosave, licensing and permission checks as UI actions.
- [ ] Keep state-changing work visible in the ordinary application UI.
- [ ] Require meaningful confirmation for irreversible, financially material or
      externally visible actions.
- [ ] Do not let an agent grant operating-system capture, accessibility or
      automation permissions.
- [ ] Surface device loss, capture failure, disk pressure and other degraded
      states instead of silently pretending the action succeeded.

## 7. Bound file and media authority

- [ ] Canonicalize and validate every caller-selected path.
- [ ] Reject traversal, NUL bytes, leading-option filenames and unsupported
      extensions before invoking a command-line media tool.
- [ ] Prevent writes into source-recording directories or other immutable
      project inputs.
- [ ] Prefer a user-selected directory capability over unrestricted absolute
      output paths, and expire that capability after the task.
- [ ] Serve local media only from the open or managed project roots; do not
      expose arbitrary `file://` access to a renderer or browser.
- [ ] Treat transcripts, OCR, frames, local paths, project names and licence
      state as potentially sensitive output.

## 8. Test the boundaries, not only the happy path

- [ ] Test non-loopback peers, unexpected `Host` and `Origin` values, wrong
      routes, methods and content types.
- [ ] Test missing, malformed, stale and incorrect credentials without leaking
      the expected value.
- [ ] Test oversized and slow requests, malformed JSON and schema edge cases.
- [ ] Test wrong job capabilities, expired results, concurrency limits and job
      timeouts.
- [ ] Test path traversal, symlink-sensitive destinations, protected project
      roots and media command argument boundaries.
- [ ] Test crash recovery, stale discovery files and process-identity mismatch.
- [ ] Verify that logs, telemetry, screenshots and published evidence contain no
      credentials or private local paths.

## 9. Publish an honest security contract

- [ ] Version the documented behavior against a release or source revision.
- [ ] Separate protocol compatibility evidence from security-assessment claims.
- [ ] State which tools were actually exercised; discovery of a tool is not
      proof that it ran safely.
- [ ] Name residual risks, including same-user processes, cloud-backed clients,
      caller-selected destinations and actions without a server-side duration.
- [ ] Provide a vulnerability-reporting route and update the document when the
      authority model changes.

Reference implementation analysis:
https://cadre.cam/guides/local-mcp-security.html