Answers · MCP security

Is it safe to install an MCP server? How to vet one first

Short answer: An MCP server can be safe, but treat it like any third-party code you hand your agent's keys to. A local (stdio) server is a program that runs on your machine with your user's permissions; a remote server receives whatever your agent sends it; and every server's tool names and descriptions go straight into your model's context, where they can carry prompt injection. Before installing, check who publishes it, read its tool list, pin the version, give it the narrowest credentials you can, keep confirmations on for actions that write, send, pay or delete, and re-review it when its tools change.

Checklist

1. Identify the publisher: the vendor's own repository or domain, or a listing in the official MCP Registry, whose namespaces are tied to a verified GitHub account or domain. Watch for look-alike names.
2. Read the tool list (tools/list) before connecting it to real data: names, descriptions and input schemas. Text addressed to the model, such as instructions to ignore rules, read other files or send data elsewhere, is a red flag.
3. Local servers: pin an exact version instead of running @latest, check the package's install scripts, and run it in a container or sandbox with limited file and network access when you can.
4. Credentials: give scoped, revocable tokens with the least privilege; never paste an admin or root key; prefer OAuth with narrow scopes.
5. Remote servers: HTTPS only, know who operates the domain, and read what they log and keep.
6. Keep human confirmation on for tools that write files, send messages, spend money or delete things.
7. Re-review after updates: a changed tool definition is a reason to look again before your agent uses it.

What can go wrong

• Tool poisoning: hidden instructions in a tool description that steer the model.
• Over-broad access: a server holding tokens or file access far beyond what its tools need.
• Supply chain: a compromised or typosquatted package, or an update that quietly changes behavior.
• The MCP specification's security best practices and the OWASP MCP Top 10 cover these risks in more depth.

Ask Rightshold (free, no key)

Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Before I install this MCP server, is it a listed, vetted app and has its tool list changed recently?”

One-click setup

{
  "tool": "check_listing",
  "arguments": {
    "url": "<the server's URL or repository>"
  }
}

• GET /v1/store/check?url=<server url> answers the same over HTTP. A server with no listing answers unknown: unvetted, which is not the same as unsafe.
• The MCP health receipts at /mcp-health record, for servers listed on Rightshold, each probe's outcome and tool-definition fingerprint, so a changed tool list is visible. They are liveness facts, not a safety finding.
• check_license with the server's GitHub, npm or PyPI page as source_url tells you what license its code is under.

Rightshold does not audit the code of arbitrary MCP servers and does not certify any server as safe; it reports what its store checks and probes actually found.

Sources

• MCP specification: Security Best Practices
• OWASP MCP Top 10
• Official MCP Registry

Related

• The Rightshold Store: vetted apps and skills
• MCP server health receipts
• How to verify an AI agent

Not legal advice. Updated 2026-10-28. JSON · Markdown · All answers

curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_...   # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
  -H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'