An MCP server extends what an agent can do. That is the point, and it is also the risk: you are granting a third-party program a channel into a session that can already read your source code and execute commands.

This checklist is for evaluating a server you did not write. None of it is exotic; it is the same care you would apply to any dependency that runs with your privileges.

Before installing

Read what it actually does. An MCP server is usually a small program. If the source is available, the tool definitions are typically one file, and reading it takes ten minutes.

Check what it asks for. A server that reads your calendar has no business requesting filesystem access. Overreach at install time is the clearest signal you will get.

Prefer servers you can pin. A version you can lock is a version that cannot change under you. Auto-updating anything that runs inside your agent session means re-granting trust silently, on someone else’s schedule.

Credentials

Never paste a long-lived credential into a tool description or prompt. Anything in the prompt is in the transcript, and the transcript may be logged, summarised, or sent onward.

Scope tokens to the minimum. If a server needs to read one repository, give it one repository. Most APIs support this and most instructions do not mention it.

Keep secrets in the environment, not in config files that get committed. A .env in .gitignore is a low bar and still catches the common mistake.

What the agent sees

Tool descriptions are part of the model’s context, and a hostile server can put instructions there. Treat tool output as untrusted input, in the same way you would treat a web page the agent fetched: content returned by a tool is data, not a directive to be obeyed.

This matters most for servers that fetch remote content. A server that returns whatever a URL contains is returning text an attacker may control.

Ongoing

  • Review connected servers periodically and remove the ones you stopped using
  • Watch for permission changes after updates
  • Run agents with the narrowest filesystem scope the task allows

What this checklist does not cover

It does not make an untrustworthy server safe, and it will not detect a deliberately malicious one that is well written. It reduces the accident surface, which is where most real problems come from.