MCP & ChatGPT apps guide
MCP server security and rate limiting checklist
Updated 2026-10-26
Short answer: Treat the AI client as an untrusted caller acting for a real user. Enforce that user's permissions server-side, keep writes narrow and confirmable, log everything, and limit rates.
Checklist
- Authorization on every call using the user's own permissions, never a shared admin key.
- Separate read and write scopes.
- Writes are idempotent, reversible where possible, and marked destructiveHint when not.
- Content from your product (ticket text, notes) can contain prompt injection; do not let it trigger writes without user confirmation.
- Per-user rate limits and payload size limits.
- Audit log: user, client, tool, arguments, result status, time.
- No secrets or internal IDs in tool descriptions or errors.
Before launch
- Run the MCP Inspector against every tool with bad inputs.
- Try to make the model delete or email something using text planted in a record.
- Have a kill switch per client or per user.
Cofounderbase build service
Get a free 2-minute demo of your product in Claude
Besides running this directory, our team builds MCP servers and ChatGPT apps for small SaaS. Send your product URL and we'll record a short video of it working inside Claude, built only from your public API docs. Free, no call needed. Pilots start at $1,500. This service is separate from the agency rankings, which it never affects.
Prefer email? Write to us. Want an outside agency instead? See agencies that do MCP work.
Agencies in our index that mention MCP work
Listed in their normal directory order. Our own build service is not part of this list or the rankings.
- Teamvoy (Ukraine)
- AiAdvisors (Poland)
- Context Studios (Germany)
- AI Agency Manchester (United Kingdom)
- Focused (United States)
- Autor Technologies (Canada)
- Pentridge (United States)
- Hourglass AI (Australia)
- Enabled Minds (United States)
- AppStream Studio (United States)
Questions
Is read-only safe?
Safer, not automatically safe. Read tools can still leak data across accounts if authorization is wrong.
Do clients ask users before calling tools?
Most clients show tool calls and ask for approval for some or all of them, but you should not rely on that alone.
Should we log prompts?
Log tool calls and arguments. Prompts are not sent to your server, only the tool calls.
More MCP guides
- How to build an MCP server for your SaaS product
- How to add a ChatGPT app to your SaaS
- MCP server development cost: what SaaS teams pay (estimates)
- MCP vs API: what SaaS teams actually need
- MCP server authentication: an OAuth 2.1 guide for SaaS teams
- MCP server for a REST API: generate from OpenAPI or hand-write?
- How to publish an MCP server: official registry, Smithery and awesome lists
- MCP server for CRM SaaS: tools, risks and scope
- MCP server for billing and subscription SaaS
- MCP server for scheduling and booking SaaS
- MCP server for healthcare SaaS: what is safe to build first
- MCP server for helpdesk and support SaaS
- Open-source example: Canny MCP server
Cost and effort figures on this page are rough estimates, not quotes.