Is MCP safe? Five checks before you connect a server

Connecting an MCP server gives an AI the ability to act in your accounts. Most servers are fine, but the risks are real and specific. These are the five checks we run on every profile, and you can run them yourself.

1. Who publishes it?

Check that the repository or endpoint belongs to the vendor. A server named after a product is not necessarily made by that company. Look for the vendor’s GitHub organization or a link from the vendor’s own documentation.

2. How does it sign in?

OAuth lets you approve specific access and revoke it later. Servers that ask for a long-lived API key or personal access token in a config file are riskier: the token often has broad access and sits in plain text on your machine.

3. What can it write or delete?

Read-only access is low risk. Tools that send messages, merge code, delete records or run arbitrary queries deserve more care. Prefer servers with a read-only mode, and turn on confirmation prompts in your AI client for write actions.

4. Hidden instructions in tool descriptions

The AI reads every tool’s description to decide what to do. A malicious or careless description can include instructions aimed at the AI, such as quietly reading files or sending data elsewhere. This is often called tool poisoning. We read the published tool descriptions and flag anything addressed to the AI that changes its behavior.

5. Is it maintained?

An archived or abandoned repository will not get security fixes. We flag servers that are archived or have had no updates for six months.