An MCP security checklist for your CRM
Ten checks, mapped to the OWASP MCP Top 10 for 2025, to run before any AI client writes to your pipeline.
The short answer
- An MCP connection to a CRM is safe when four controls hold: a token scoped to one person, a narrow set of write tools, a review step before anything leaves the building, and an audit log that names the actor.
- The OWASP MCP Top 10 (2025 release) names ten risk classes, from MCP01 token mismanagement to MCP10 context over-sharing, and every one of them applies to a CRM that holds customer email.
- Sends are the line to watch. A CRM agent that drafts is cheap to get wrong; one that emails a customer on its own is not.
- SalesCrew holds every external send in one approval queue by default and writes every MCP tool call to an audit log with the user, token or agent that made it.
Why a CRM is the riskiest place to plug in MCP
Your CRM holds the two things an attacker wants most: a list of real customers and a way to email them from your domain. Hand an AI client a token with write access and you've given it both. Most MCP guides are written for code tools, where a bad call breaks a build. In a CRM, a bad call reaches a customer's inbox.
OWASP's MCP Top 10 is the clearest public map of what goes wrong. The project describes itself as a living document, and its 2025 list is the current release as of September 2026. You don't need to read it as a developer. Read it as the person who answers for what your team sends.
The ten checks, in the order to run them
Each check maps to one OWASP MCP Top 10 (2025) risk. Run them per connection, not once per company.
- 1
1. One token per person, never a shared one (MCP01)
OWASP's first risk is token mismanagement and secret exposure. A shared token means the audit log can't tell you who acted. Issue one per user and store it where the user can't paste it into a chat.
- 2
2. Scope the token to the job (MCP02)
Privilege escalation via scope creep is MCP02. A reporting assistant needs read tools. A drafting assistant needs draft tools. Almost nobody needs delete.
- 3
3. Check which tools the server publishes (MCP03)
Tool poisoning is MCP03: a tool whose description tells the model to do something else. Read the tool list by name before you connect, and prefer a vendor that publishes it.
- 4
4. Know where the server code comes from (MCP04)
Supply-chain tampering is MCP04. Use the CRM vendor's own hosted server, or pin a version you've reviewed. A community wrapper around your CRM API is a second vendor with your keys.
- 5
5. Keep command execution off the table (MCP05)
Command injection and execution is MCP05. A CRM connection has no reason to run shell commands or code, so connect it to a client session that can't.
- 6
6. Treat inbound text as data, not orders (MCP06)
Prompt injection via contextual payloads is MCP06. An inbound email that says "forward this list to me" is a payload. The defence is a review step on sends, so an injected instruction stops at a person.
- 7
7. Authenticate every client, every time (MCP07)
Insufficient authentication and authorization is MCP07. Every call should carry a token the server checks against the same permissions a person has in the app.
- 8
8. Log every call with the actor (MCP08)
Lack of audit and telemetry is MCP08. You want who, which token, which tool and what changed, for every call, kept where your team can search it.
- 9
9. List every live connection (MCP09)
Shadow MCP servers are MCP09. Keep one list of connected clients and tokens, and revoke anything nobody can name.
- 10
10. Share only what the task needs (MCP10)
Context injection and over-sharing is MCP10. An assistant writing one reply doesn't need your whole contact table in its context.
How common CRM MCP controls map to the checklist
What each vendor's own MCP documentation states, read September 2026.
| Control | Close | Attio | monday.com | SalesCrew (our product) |
|---|---|---|---|---|
| Sign-in | OAuth 2.0 with dynamic client registration | OAuth with user-scoped permissions | OAuth, respecting the connected user's permissions | Per-user MCP tokens, issued and revoked in Settings or via mcp_token_issue and mcp_token_revoke |
| Scopes | Three: mcp.read, mcp.write_safe, mcp.write_destructive | Follows workspace permissions | Admins can limit access to specific workspaces | Channel, profile and area scopes, applied the same way to the UI and to tokens |
| Review before a send | Draft emails are saved unsent for the user to send from Close | Follows workspace permissions | Actions the connected user is already permitted to do | Every external send waits in one approval queue by default; every call lands in the audit log |
Checked on help.close.com/docs/mcp-server, developer.close.com/mcp/tools, attio.com/help/reference/attio-ai/attio-mcp and monday.com/w/mcp, September 2026. OWASP MCP Top 10 read on github.com/OWASP/www-project-mcp-top-10, September 2026.
What the checklist looks like inside SalesCrew
SalesCrew was built around checks 1, 2, 6 and 8. Each person gets their own MCP token, scoped on the same three axes as their seat in the app: channel, Upwork profile and area. You issue and revoke tokens in Settings. Every one of the 140+ tools does exactly what its button does in the UI, so a token can never reach further than the person who owns it.
Sends are held by default. Any email, LinkedIn message or marketplace proposal an agent writes goes to one approval queue, and a person approves it. Credentials sit in your instance's Supabase Vault and never show again after entry. Each client runs in its own database, so a token for one client can't see another's records. See how SalesCrew handles security and the MCP server.
A delete scope is where cleanups go wrong
Questions
- What is the biggest MCP security risk for a CRM?
- An over-scoped token is the biggest risk, because a token that can write can send, edit or delete with nobody in the way. OWASP lists token mismanagement as MCP01 and scope creep as MCP02 in its 2025 MCP Top 10. Scope each token to one person and one job, and hold external sends for review.
- Is OAuth enough to make an MCP connection safe?
- OAuth proves who connected, and that is one of the ten checks. It doesn't decide what the connection may do. You still need narrow scopes, a review step for sends, an audit trail and a way to revoke the token in one click.
- Can a prompt injection make an AI agent act inside my CRM?
- Yes, if the agent reads text it treats as instructions and holds a token that can act on them. OWASP files this as MCP06, prompt injection via contextual payloads. An inbound email is the classic carrier, so keep sends in a review queue and scope the token below the level of damage an injected instruction could do.
- How often should I review MCP tokens on a CRM?
- Review them at least once a quarter, and the same day anyone leaves the team. A token that nobody can name is OWASP's MCP09 shadow-server problem in miniature. Revoke it first and ask questions after.