Checklist: Before the workshop

This self-serve checklist gets you ready for the Securing MCP Servers workshop. Work through it top to bottom; tick each box as you complete it. You should be done in under 30 minutes if your machine already has a recent Python and a working terminal.

Total: 7 steps. The workshop itself is not about installing MCP servers. Once you finish Step 5, you’re ready for the workshop.

---

Step 0 — Pre-read (~30 min the night before)

We’ll discuss all of these during the workshop. Skimming them ahead of time means you can spend the workshop diving into the material instead of reading it for the first time. You do not need to memorize anything.

• [ ] MCP specification 2025-11-25 — focus on the Security Best Practices and Authorization pages.
• [ ] OWASP MCP Top 10 — read the top-level taxonomy. You do not need to memorize the IDs; recognizing the categories (tool poisoning, token passthrough, prompt injection, etc.) is enough.

---

Step 1 — Fork and clone

• [ ] Fork the upstream mcp-security-workshop repo on GitHub.
• [ ] Rename your fork on GitHub to mcp-security-workshop- (e.g. mcp-security-workshop-jane-doe). Your peers will use this naming to distinguish forks during interactive exercises.
• [ ] Clone your renamed fork and set a shell variable you can reuse below:

  git clone https://github.com//mcp-security-workshop-.git
  cd mcp-security-workshop-
  export WORKSHOP_DIR="$(pwd)"
  

---

Step 2 — Local environment

• [ ] Confirm Python 3.11 or newer is installed:

  python3 --version    # need >= 3.11
  

  If you need to install it:

  # macOS:
  brew install [email protected]
  # Linux (pyenv):
  pyenv install 3.11.9 && pyenv global 3.11.9
  

• [ ] Install uv (the Python package/venv manager this repo uses):

  curl -LsSf https://astral.sh/uv/install.sh | sh
  exec $SHELL          # reload PATH so `uv` is on it
  uv --version         # sanity check — should print a version number
  

• [ ] Sync dependencies (creates a project-local virtualenv and installs everything):

  cd "$WORKSHOP_DIR"
  uv sync
  

---

Step 3 — Dependency sanity check

• [ ] Verify the core libraries actually import cleanly:

  uv run python -c "import mcp, httpx, jwt, yaml, starlette; print('ok')"
  

  Expected output: ok. Anything else means uv sync did not finish — re-run it and re-check.

---

Step 4 — Register MCP servers in your client