{
  "question": "Is it safe to install an MCP server? How to vet one first",
  "slug": "how-to-vet-an-mcp-server-before-installing-it",
  "url": "https://www.rightshold.com/answers/how-to-vet-an-mcp-server-before-installing-it",
  "short_answer": "An MCP server can be safe, but treat it like any third-party code you hand your agent's keys to. A local (stdio) server is a program that runs on your machine with your user's permissions; a remote server receives whatever your agent sends it; and every server's tool names and descriptions go straight into your model's context, where they can carry prompt injection. Before installing, check who publishes it, read its tool list, pin the version, give it the narrowest credentials you can, keep confirmations on for actions that write, send, pay or delete, and re-review it when its tools change.",
  "checklist": [
    "Identify the publisher: the vendor's own repository or domain, or a listing in the official MCP Registry, whose namespaces are tied to a verified GitHub account or domain. Watch for look-alike names.",
    "Read the tool list (tools/list) before connecting it to real data: names, descriptions and input schemas. Text addressed to the model, such as instructions to ignore rules, read other files or send data elsewhere, is a red flag.",
    "Local servers: pin an exact version instead of running @latest, check the package's install scripts, and run it in a container or sandbox with limited file and network access when you can.",
    "Credentials: give scoped, revocable tokens with the least privilege; never paste an admin or root key; prefer OAuth with narrow scopes.",
    "Remote servers: HTTPS only, know who operates the domain, and read what they log and keep.",
    "Keep human confirmation on for tools that write files, send messages, spend money or delete things.",
    "Re-review after updates: a changed tool definition is a reason to look again before your agent uses it."
  ],
  "sections": [
    {
      "heading": "What can go wrong",
      "points": [
        "Tool poisoning: hidden instructions in a tool description that steer the model.",
        "Over-broad access: a server holding tokens or file access far beyond what its tools need.",
        "Supply chain: a compromised or typosquatted package, or an update that quietly changes behavior.",
        "The MCP specification's security best practices and the OWASP MCP Top 10 cover these risks in more depth."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Before I install this MCP server, is it a listed, vetted app and has its tool list changed recently?",
    "mcp_call": {
      "tool": "check_listing",
      "arguments": {
        "url": "<the server's URL or repository>"
      }
    },
    "also": [
      "GET /v1/store/check?url=<server url> answers the same over HTTP. A server with no listing answers unknown: unvetted, which is not the same as unsafe.",
      "The MCP health receipts at /mcp-health record, for servers listed on Rightshold, each probe's outcome and tool-definition fingerprint, so a changed tool list is visible. They are liveness facts, not a safety finding.",
      "check_license with the server's GitHub, npm or PyPI page as source_url tells you what license its code is under."
    ],
    "scope": "Rightshold does not audit the code of arbitrary MCP servers and does not certify any server as safe; it reports what its store checks and probes actually found."
  },
  "sources": [
    {
      "title": "MCP specification: Security Best Practices",
      "url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices"
    },
    {
      "title": "OWASP MCP Top 10",
      "url": "https://owasp.org/www-project-mcp-top-10/"
    },
    {
      "title": "Official MCP Registry",
      "url": "https://registry.modelcontextprotocol.io/"
    }
  ],
  "related": [
    {
      "title": "The Rightshold Store: vetted apps and skills",
      "url": "https://www.rightshold.com/store"
    },
    {
      "title": "MCP server health receipts",
      "url": "https://www.rightshold.com/mcp-health"
    },
    {
      "title": "How to verify an AI agent",
      "url": "https://www.rightshold.com/how-to-verify-an-ai-agent"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-10-28"
}