MCP Security for Small Businesses

MCP security for a small business comes down to a few habits: connect only servers from companies you can identify, give AI tools the least access that works, keep a person approving anything that sends, pays or deletes, and keep your apps updated. You do not need a security team to do this. You need a short list, an owner and an hour a quarter.

MCP (Model Context Protocol) is the standard that lets AI apps like Claude or ChatGPT connect to your other tools, such as email, files, accounting or your CRM. Each connection is called an MCP server. Connecting one is easy, which is exactly why it needs a little care.

This guide is for owners and office managers, not engineers. It was checked against official sources on 28 October 2026.

The risks that matter for a small business

You do not need to learn every attack name. Four ideas cover most of the risk.

1. Fake or bad servers. In September 2025, Postmark warned that a package called "postmark-mcp" was not theirs. Postmark says its author built trust over 15 versions, then added a backdoor that blind-copied emails to an outside server.
2. Hidden instructions. An AI can read text, such as an email or a support ticket, that tells it to do something you did not ask for. This is called prompt injection.
3. Too much access. If an AI tool can read everything and send email, one mistake or trick can leak a lot.
4. Out-of-date software. MCP apps and tools have had real security flaws, each fixed in a newer version. Our incident tracker lists examples.

Developer Simon Willison calls the dangerous combination the "lethal trifecta": access to private data, exposure to untrusted content, and a way to send data out. If one AI setup has all three, add approvals or split the tools.

Ten practical rules

1. Keep a list. A spreadsheet with each MCP server, what it connects to, who added it and when.
2. Use the vendor's own server. For example, connect your accounting app through the server its maker publishes. Check the publisher's name matches the vendor's documentation.
3. Prefer remote servers with sign-in. Remote servers that use your normal account login (OAuth) avoid storing long-lived keys on laptops.
4. Start read-only. Turn on write access only for a task that needs it.
5. Approve risky actions. The MCP tools specification says there "SHOULD always be a human in the loop with the ability to deny tool invocations." Use that for sending, paying and deleting.
6. Do not mix untrusted inboxes with powerful tools. An AI reading customer emails should not also be able to send files out without approval.
7. Protect your accounts. CISA's small business guidance puts multifactor authentication first, especially for email and admin accounts. "Any form of MFA is better than no MFA," it says.
8. Update promptly. CISA also recommends turning on automatic updates where possible. That includes your AI apps and any MCP tools on your computers.
9. Be careful with local installs. Some MCP servers run on your own computer. Install only from known publishers, and do not approve an install command you have not read.
10. Review quarterly. Remove what nobody uses, and check that access still makes sense.

A one-page staff policy

Copy this and adapt it. It is a starting point, not legal advice. For a fuller version, use our AI and MCP acceptable use policy template.

AI TOOL CONNECTIONS (MCP): STAFF RULES
Owner: [name]          Last reviewed: [date]

1. Ask [owner] before connecting any AI app to a company account.
2. Use only the connections on the approved list: [link].
3. New connections start read-only unless [owner] approves more.
4. Always review before the AI sends email, makes a payment,
   deletes anything or shares a file outside the company.
5. Never paste passwords, API keys or customer card data into an AI app.
6. Do not install AI add-ons or MCP servers on your computer
   without approval.
7. If the AI does something you did not ask for, stop, take a
   screenshot and tell [owner] right away. You will not be blamed.

Simple choices that cut risk

If something goes wrong

Signs to watch for include emails you did not send, files shared without your action, unexpected charges, or an AI app asking to install something new.

1. Disconnect the server in your AI app.
2. Change the password and revoke access for the connected account. Most apps list connected apps under security settings.
3. Note what you saw, with times and screenshots.
4. Check sent mail, file sharing and payment history for the affected account.
5. Get help if customer data may be involved.

CISA recommends having a written incident response plan and using it "even when you suspect a false alarm." Our guide to MCP incident response has a fuller playbook.

Next step

Not sure where to start? Our MCP readiness audit reviews what your business has connected and gives you a short, prioritized fix list. If you are still deciding whether you need MCP at all, read MCP for small business: do you need it yet?

Frequently asked questions