MCP security: questions to ask before installing a server or skill

Before installing an MCP server or agent skill, ask six questions: what it can read and change, where it runs, which credentials it needs, what code runs when you install and start it, whether it reads untrusted content, and who publishes and maintains it. The answers tell you how much access to give it, or whether to install it at all.

Servers and skills both let an AI agent act for you. The MCP specification says tools amount to arbitrary code execution and must be treated with care, and Anthropic says to treat installing a skill like installing software. This guide turns that advice into a checklist.

1. What can it read and change?

Start with the list of tools. A server that only searches documentation is very different from one that can delete files, send email or move money.

• Read the README and the tool list. Look for words such as create, update, delete, send, run or execute.
• Check whether the server separates read-only tools from write tools. ChatGPT, for example, treats every tool as a write action needing confirmation unless the server marks it read-only.
• Do not rely on the description alone. The MCP specification says tool descriptions and annotations should be considered untrusted unless they come from a trusted server.

Kitbay's server listings record whether a server can change data, with the evidence behind that field.

2. Does it run on your computer or online?

Local servers run on your machine with your user account's permissions. The MCP documentation is plain about this: a file system server can do any file operation you could do yourself. Its security guidance also describes a local-server risk where a malicious start command hidden in a config snippet runs as soon as the client launches it.

Remote servers run on someone else's infrastructure. Your data travels to them, and they act through the account you sign in with. Check who operates the server and what their privacy terms say.

For local servers, prefer stdio. If a local server opens an HTTP port, the specification says it should listen only on 127.0.0.1 and check the Origin header, otherwise a website could reach it through DNS rebinding.

3. What credentials does it need?

• Use the narrowest key you can. Create a token with read-only or limited scopes if the service allows it. The MCP security guidance warns that broad scopes widen the damage if a token leaks.
• Prefer OAuth for remote servers, so you can see the scopes requested and revoke access later. In Claude Code, removing a server deletes its stored tokens locally, but the documentation says to log out first if you want them revoked at the provider.
• Keep secrets out of shared files. Use environment variables or the client's secret prompts. VS Code's inputs feature and Cursor's ${env:NAME} variables exist for this.
• Watch for token handling on hosted servers. The specification forbids a server from accepting tokens that were not issued for it.

4. What code runs, and when?

For a server, read the exact install command. A line such as npx -y some-package downloads and runs the latest published version each time. Check that the package name matches the project's repository, and consider pinning a version.

For a skill, look inside every file, not just SKILL.md. Anthropic's skill documentation lists the things to look for: unexpected network calls, file access that does not match the purpose, and instructions that pull content from outside URLs, since that content can change later. In Claude Code specifically:

• a line written as !`command` in a skill runs on your machine before Claude even sees the skill;
• a project skill's allowed-tools setting applies even in a folder you have never marked as trusted, so the documentation advises reviewing it before running Claude Code in a new repository;
• skills have the same network access as any other program on your computer.

5. Does it read content from strangers?

Prompt injection is the risk that text the agent reads contains instructions aimed at it. A server that fetches web pages, emails, issues or support tickets brings that text into the conversation. Claude Code's documentation warns specifically about servers that fetch outside content, and OpenAI labels custom MCP servers in ChatGPT as elevated risk, noting that an untrusted server could trick the model into misusing tools.

Combining tools raises the stakes. A server that reads public content and another that can send data out give an injected instruction both a source and an exit. Keep those combinations to tasks where you watch each step.

6. Who publishes it, and is it maintained?

• Is it published by the tool's own vendor or by an independent developer? Kitbay marks vendor-published listings on the official listings page only with evidence.
• Is the source code public, and does the repository match the package you install?
• When was it last updated, and does it have a licence?
• Are reported security issues answered?

Unmaintained code is not always unsafe, but it will not receive fixes.

Use your client's safety controls

Most clients give you controls; use them rather than switching them off.

Approval prompts only help if you read them. Check the tool name and arguments before accepting, especially for anything that sends, deletes or pays.

A quick checklist

Where Kitbay fits

Kitbay records facts from each project's own sources, such as whether a listing can change data, whether it is local or remote, and whether a skill includes scripts. We do not test or audit listings, so treat these fields as a starting point and review the source yourself. For background, see what an MCP server is, what a Claude skill is, and how to connect servers to AI clients. You can browse agent skills with the same fields.