Your first MCP review as a junior analyst
Given an AI tool change ticket and unsure where to start? Identify the evidence, compare the change and ask the owner concrete questions without claiming more than you observed.
Suppose a ticket says, “The team's AI assistant has a new MCP connection. Please review.” You have two configuration files, but no alert showing an attack. Your starting task is to understand the proposed change and route unresolved questions. You do not need to prove the server safe or run an unfamiliar command.
What is MCP, in this ticket?
Model Context Protocol is a way for an AI application to work with external tools and data. The client is the application making the connection. The server offers capabilities, such as searching notes. A local server can be a program launched on the workstation; a remote server has a network address. “Server” does not necessarily mean a separate physical computer.
Start with three questions
- What evidence was supplied? A client config tells you what the application is configured to launch or contact. A captured tool list tells you what one server advertised. Neither is an execution log. Choose the matching mode in the workbench.
- What changed from the approved baseline? Compare the known before snapshot with the proposed after snapshot. If no previous baseline exists, use an explicit empty collection and record that this is a first review.
- Who can explain the intended access? Find the application owner, purpose, environment and approval record. Ask where the program runs and which data it needs. A missing owner is an unresolved review item, not evidence of malicious activity.
Try the example before handling a real ticket
Open the workbench, keep Client config selected and choose Load worked example. Select Review changes. The report shows a package argument change, a path argument change, an extra environment key and a new HTTP endpoint. It clears the raw input text and hides values in the output.
For the new endpoint, a useful note is: “The proposed snapshot adds archive.example.test over HTTP. Owner and approved transport are not yet confirmed.” Avoid “data exfiltration detected.” The tool has not observed traffic or data movement.
For a changed argument, the report shows its numbered position, such as /args/2. JSON arrays count from zero, so this is the third argument. Values remain hidden in exports. Open the local inspector and explicitly reveal the exact before and after values; review their meaning with the owner.
Translate the vocabulary
| Term | Plain meaning | Question to ask |
|---|---|---|
| Command and arguments | A program to start and the inputs passed to it. | What will run, under whose account, with what access? |
| Environment variable | A named setting passed to a process, sometimes containing a credential. | Who owns the credential and what can it access? |
| Endpoint origin | The URL's scheme, hostname and port; not the full address. | Is this the intended service and environment? |
| Tool schema | A definition of the inputs or outputs a tool advertises. | Did the accepted input or described behavior change? |
| Annotation | A server-supplied hint about tool behavior. | What evidence supports this claim? |
| Pagination | A large list split into multiple response pages. | Do we have every page under the same access context? |
| Scope | The limits of a permission or an approval. | Which exact actions and data are authorized? |
When to hand off
Follow your team's escalation process when the owner is unknown, the requested access exceeds the stated purpose, the complete command cannot be reviewed, a credential scope is unexplained, or evidence suggests actual unauthorized activity. Include the observation, the missing evidence and the person or team needed next.
Do not disconnect a production integration, rotate credentials, launch the proposed program or test an endpoint just because a review prompt appears. Those are separate operational actions under your organization's authorization and incident procedures.
A first-pass note you can use
Observed: the proposed config adds a remote HTTP origin. Evidence: before/after configuration, not network telemetry. Unknown: service owner, intended environment, transport approval. Requested: owner confirmation and approved connection details. Status: review pending; no execution or compromise claim made.
For an actual AI incident, collect the relevant activity records through your team's approved tools. Microsoft's AI investigation guidance centers on reconstructing activity and determining data involvement and authorization. This static comparison can support that investigation, but cannot reconstruct it.
Continue to the complete worked configuration review or the handoff template.