A security checklist for connecting AI to your ERP: 12 questions for any MCP vendor

Connecting an AI assistant to a job-cost or accounting system is a bigger decision than installing an app. The assistant will run queries on behalf of many people, and what it reads can be summarised, copied and, if something goes wrong, acted on. The good news is that the protocol and the security community have already written down most of what to ask.

This checklist draws on three sources: the MCP specification's authorization section and security best practices, OWASP's Top 10 for LLM applications, and Anthropic's guidance on custom connectors.

Access and permissions

1. Can it change anything, or only read?

OWASP's guidance on excessive agency says an AI system with too much ability to call tools can take damaging actions based on unexpected or manipulated output, and the root causes are excessive functionality, permissions or autonomy. The simplest defence for finance data is a connector that only reads. Ask how that is enforced in the connector, not just promised.

2. Does each person see only what they should?

OWASP recommends enforcing authorization in the downstream system instead of relying on the model's decisions. For you that means limits by system, kind of data and job that are applied to every query on the server, not instructions given to the assistant.

3. Who controls access to sensitive fields?

Job cost rarely needs social security numbers or wages, but some people do. Ask who decides which people may see payroll or personal records, and whether that is enforced by the connector on every query, not by a menu the assistant can ignore.

4. Is there a human in the loop for anything risky?

OWASP lists human approval for high-impact actions as a preventive measure. If a connector never writes, the question reduces to confirming that, but a vendor that offers write tools should say exactly which ones and how approval works.

Sign-in and tokens

5. Does it use OAuth 2.1 with PKCE?

The MCP authorization specification is built on OAuth 2.1, and requires clients to use PKCE with the S256 method when capable. It also requires exact validation of redirect addresses.

6. Are tokens issued for this server only?

The specification says servers must accept only tokens issued specifically for them (audience binding) and must not pass tokens through to other services. The security best practices call token passthrough an anti-pattern because it bypasses controls and muddies audit trails.

7. Are tokens short-lived and refresh tokens rotated?

The specification advises short-lived access tokens, and requires refresh-token rotation for public clients. Ask what happens if a refresh token is used twice.

8. How are scopes decided?

Scope minimization is its own section in the best-practices document: broad, catch-all scopes make a stolen token far more damaging. Ask for the smallest set that supports the job.

Network, data and operations

9. How does it reach on-premise systems?

A design that needs an inbound firewall port or a VPN into your accounting server is a larger risk than one where a small program inside your network connects outward. Ask which it is. The same question applies to any URL the server fetches on a customer's behalf: the best-practices document describes server-side request forgery, where a server is tricked into reaching internal addresses, and recommends blocking private ranges.

10. What is logged, and what is not?

You want an audit trail of who asked which tool of which system and whether it succeeded. You do not want the values from your ledger copied into logs. OWASP notes logging and monitoring do not prevent excessive agency but limit the damage when something goes wrong.

11. What do error messages reveal?

Error text shown to an assistant can leak hostnames, driver messages or secrets. Ask to see what a failed query returns.

12. How fast can you switch a person or the whole connector off?

Anthropic's guidance says server behaviour can change and to watch tool activity. You should be able to disable one person, one system or the whole connector from your own console, within minutes, and revoke tokens.

How Junction answers these

Our security page lists these controls. Ask every vendor to show you theirs, and to say plainly what they log and what they never record. Ready to try Junction? Get started and connect in minutes (about an hour for on-premise systems).