A security checklist for connecting AI to your ERP: 12 questions for any MCP vendor

Connecting an AI assistant to a job-cost or accounting system is a bigger decision than installing an app. The assistant will run queries on behalf of many people, and what it reads can be summarised, copied and, if something goes wrong, acted on. The good news is that the protocol and the security community have already written down most of what to ask.

This checklist draws on three sources: the MCP specification's authorization section and security best practices, OWASP's Top 10 for LLM applications, and Anthropic's guidance on custom connectors.

Access and permissions

1. Can it change anything, or only read?

OWASP's guidance on excessive agency says an AI system with too much ability to call tools can take damaging actions based on unexpected or manipulated output, and the root causes are excessive functionality, permissions or autonomy. The simplest defence for finance data is a connector that can only read. Ask how that is enforced in the connector, not just promised, and whether the database login or API key it uses can write.

2. Does each person see only what they should?

OWASP recommends enforcing authorization in the downstream system instead of relying on the model's decisions. For you that means limits by system, kind of data and job that are applied to every query on the server, not instructions given to the assistant.

3. Are payroll and personal records excluded by default?

Job cost does not need social security numbers or wages. A connector should refuse these fields by default, not merely hide them from a menu.

4. Is there a human in the loop for anything risky?

OWASP lists human approval for high-impact actions as a preventive measure. If a connector never writes, the question reduces to confirming that, but a vendor that offers write tools should say exactly which ones and how approval works.

Sign-in and tokens

5. Does it use OAuth 2.1 with PKCE?

The MCP authorization specification is built on OAuth 2.1, and requires clients to use PKCE with the S256 method when capable. It also requires exact validation of redirect addresses.

6. Are tokens issued for this server only?

The specification says servers must accept only tokens issued specifically for them (audience binding) and must not pass tokens through to other services. The security best practices call token passthrough an anti-pattern because it bypasses controls and muddies audit trails.

7. Are tokens short-lived and refresh tokens rotated?

The specification advises short-lived access tokens, and requires refresh-token rotation for public clients. Ask what happens if a refresh token is used twice.

8. How are scopes decided?

Scope minimization is its own section in the best-practices document: broad, catch-all scopes make a stolen token far more damaging. Ask for the smallest set that supports the job.

Network, data and operations

9. How does it reach on-premise systems?

A design that needs an inbound firewall port or a VPN into your accounting server is a larger risk than one where a small program inside your network connects outward. Ask which it is. The same question applies to any URL the server fetches on a customer's behalf: the best-practices document describes server-side request forgery, where a server is tricked into reaching internal addresses, and recommends blocking private ranges.

10. What is logged, and what is not?

You want an audit trail of who asked which tool of which system and whether it succeeded. You do not want the values from your ledger copied into logs. OWASP notes logging and monitoring do not prevent excessive agency but limit the damage when something goes wrong.

11. What do error messages reveal?

Error text shown to an assistant can leak hostnames, driver messages or secrets. Ask to see what a failed query returns.

12. How fast can you switch a person or the whole connector off?

Anthropic's guidance says server behaviour can change and to watch tool activity. You should be able to disable one person, one system or the whole connector from your own console, within minutes, and revoke tokens.

How Junction answers these

Our security page lists these controls and, as importantly, what is not done yet: for example, we have not completed a SOC 2 audit or an independent penetration test, and each real system is validated with a design partner before we call it live. Ask every vendor for that second list.