This article is part of our MCP Guide: what the Model Context Protocol is, how to use it safely, and how to choose servers, tools and help. Want a second opinion on your setup? Request a free MCP readiness review.
To choose an MCP server, check five things first. Who publishes it? What can it change? How does it log in? What data does it expose? Does anyone still maintain it? Features come after that. A server with great tools and a weak answer on any of those five is not ready for business data.
An MCP server is a small program that lets an AI app, such as Claude or ChatGPT, use another tool on your behalf. It might read your analytics, update a CRM record or issue a refund. That makes the choice closer to hiring a contractor than installing a browser extension.
This checklist uses real examples from vendor docs we checked on 28 October 2026. If you are new to the idea, start with What Is MCP?.
Key Takeaways
- Prefer servers published by the vendor that owns the data, and say clearly when a server is community-built.
- Start read-only, and only turn on write tools for a named task with a named owner.
- Choose OAuth sign-in or scoped keys over full-access API keys whenever the vendor offers them.
- Check what data the server can return, including personal data, before you connect it to a shared AI workspace.
- Confirm the project is maintained, because some vendor repos have been archived and replaced by hosted servers.
- Make sure someone can see a log of what the AI did and revoke its access in one place.
Why the choice matters more than with a normal app
The MCP specification itself is cautious about tools. It says that "there SHOULD always be a human in the loop with the ability to deny tool invocations," according to the tools section of the 2026-07-28 spec. It also says clients must treat a server's own description of a tool's behavior as untrusted unless the server is trusted.
In plain terms, the protocol gives the AI a way to act. It does not decide whether a given server is safe for your business. That decision is yours, and the checklist below is how to make it.
For the security background, read MCP Security Risks and How to Reduce Them.
The 12-point checklist
Use this as a scorecard. A server does not need a perfect score, but every "no" should be a decision someone made on purpose.
| # | Question | What a good answer looks like |
|---|---|---|
| 1 | Who publishes it? | The vendor that owns the data, in its own docs or GitHub org |
| 2 | Hosted or local? | You know where it runs and who operates it |
| 3 | How does it log in? | OAuth, or a scoped key made for agents |
| 4 | Can it write, or only read? | Read-only by default; writes switched on deliberately |
| 5 | Can you limit the tools? | Flags, scopes or admin settings to turn tools off |
| 6 | Does it pause for risky actions? | Human confirmation on money or deletes |
| 7 | What data can it return? | Documented, with sensitive fields excluded or flagged |
| 8 | Is it maintained? | Recent releases, not archived or "experimental" only |
| 9 | What does it cost to run? | Clear plan limits or usage units |
| 10 | Can an admin control access? | Team-level on/off and session revocation |
| 11 | Is there an audit trail? | Logs of tool calls you can review |
| 12 | Does it fit your AI app? | Works with the client your team already uses |
The sections below explain each one with examples.
1. Who publishes the server?
Anyone can write an MCP server for any product. So the first question is whether the company that owns the data published it.
Look for the server in the vendor's own developer docs or GitHub organization. For example, Google documents an official Google Ads MCP server and links its repo. Xero publishes its server under its own XeroAPI GitHub organization.
Community servers can be good, but treat them like any open-source dependency. Read the code or have a developer read it. For Google Search Console, for instance, the servers we found as of October 2026 were community projects such as ahonn/mcp-server-gsc, not Google-published ones.
A listing in a directory is not proof of quality. The official MCP Registry repo says the registry validates namespace ownership when someone publishes. It does not describe any security review of the servers themselves. See What Is the MCP Registry? for how listings work.
2. Hosted or local?
A hosted (remote) server runs on the vendor's infrastructure. You connect by URL and sign in. A local server runs on your own computer, often started with a command like npx or pipx.
Both can be fine. They carry different risks.
- Hosted servers keep your keys off laptops, and the vendor patches them. You are trusting the vendor's operations.
- Local servers run with your computer's permissions. The spec's security best practices warn that local servers can run "any command with MCP client privileges" if they come from an untrusted source.
If a local server is the only option, install it from the vendor's official package, not a fork.
3. How does it log in?
Sign-in is where most risk lives. Ranked from better to worse:
- OAuth sign-in. You approve access in a browser window and can revoke it later. HubSpot's remote MCP server requires OAuth with PKCE, a safer variant of OAuth for apps.
- Keys built for agents. Stripe now offers agent API keys for its MCP server. Its MCP docs say that from December 2026 it will stop accepting full-access secret keys and restricted keys without the Agent tag.
- General API keys pasted into a config file. These often carry full account access. Use them only when nothing else exists.
The spec's scope minimization guidance explains why: a stolen token with broad scopes gives an attacker everything at once. Ask for the narrowest access that does the job.
Our guide to MCP Authentication and OAuth 2.1 walks through the sign-in flow step by step.
4. Can it write, or only read?
Read-only servers answer questions. Write-enabled servers change things. Start with read.
Some vendors make this easy:
- Google says its Ads MCP server is "strictly read-only" in the current release. It cannot change bids, pause campaigns or create assets.
- The Google Analytics MCP server is mostly read-only. Its one write tool, for creating property annotations, needs a separate
--allow-writeflag and an edit scope.
If you do need writes, list exactly which actions and who approved them.
5. Can you switch tools off?
Good servers let you trim the tool list. Fewer tools means fewer ways for the AI to go wrong.
Look for settings like these. The QuickBooks Online server in Intuit's GitHub organization has flags that stop create, update or delete tools from loading. Read tools stay available. On the client side, most AI apps also let you disable individual tools.
6. Does it pause before risky actions?
Money movements and deletions deserve a second look from a person. Some vendors build that in.
Stripe says it requires human confirmation before certain write actions, "such as refunds and outbound payments." You approve through a link, and the request expires after 24 hours. That is the kind of safeguard to look for in any server that touches payments.
7. What data can it return?
Ask what the AI will see. Then ask where that output goes, because chat logs can be stored and shared inside your AI workspace.
HubSpot is a useful model here. Its docs say that when Sensitive Data is turned on, conversation and activity data are blocked from the MCP server. WooCommerce's MCP docs warn that order and customer tools may expose personal data and recommend a dedicated user with only the needed permissions.
8. Is it maintained?
MCP moves quickly. Servers get replaced, renamed and archived.
Ahrefs is a clear example. Its old local server repo now says it "IS NOT maintained" and points to a hosted server instead. Shopify removed the catalog and cart tools from its original storefront endpoint and moved them to a new protocol, as its Storefront MCP docs explain.
Check the last release date, open issues and any "experimental" or "preview" label. The Google Analytics server, for example, still calls itself experimental.
9. What does it cost to run?
Many servers are free to connect but draw on a paid plan. Read the limits.
- Ahrefs' MCP docs say the hosted server needs a Lite plan or higher. Calls use API units from your monthly allowance, and new OAuth keys default to 200,000 units per key per month.
- Semrush's MCP page lists which plans include access and says each request consumes API units.
An AI agent can make many calls in one conversation. Set per-key limits where the vendor allows it.
10–11. Admin control and audit trails
Someone in your company should be able to answer two questions at any time. Who has connected this server? What has the AI done with it?
Look for team-level switches and session lists. Stripe lets admins turn MCP access on or off for the whole team and revoke individual OAuth sessions from the Dashboard. For larger teams, an MCP gateway can add one central log across many servers. Read MCP Gateways Explained and MCP for IT Leaders for that layer.
12. Does it work with your AI app?
Finally, check that the server supports the client your team uses. Most vendor docs list setup steps per app. Stripe, for example, documents setup for Claude Code, Claude Desktop, Codex, ChatGPT, Cursor and VS Code. See Which AI Apps Support MCP? for the wider picture.
A simple scoring method
Give each of the 12 questions a green, amber or red.
- Green: the vendor documents a good answer.
- Amber: a workable answer exists, but it depends on how you configure it.
- Red: no answer, or a risky default you can't change.
Any red on questions 1, 3, 4 or 7 should stop a rollout until it is resolved. Ambers are fine for a pilot with test data. Re-score each server every quarter, since vendors change their servers often.
Next step
If you want a second pair of eyes before connecting servers to live data, our MCP readiness audit reviews your planned servers against this checklist.
Frequently asked questions
Are official MCP servers always safer than community ones?
Not always, but they are a better starting point. The vendor knows its own API, controls the sign-in flow and usually patches faster. A well-reviewed community server can be fine, as long as someone on your team has read the code and you know who maintains it.
Should I let an AI write to my systems through MCP?
Only for specific tasks, after a read-only trial. Turn on write tools one at a time and keep human confirmation for anything involving money, deletions or customer messages. The MCP spec itself recommends a human in the loop who can deny tool calls.
How many MCP servers should a small business connect?
As few as the job needs. Every server adds tools the AI can call and data it can see. Start with one or two that answer a real question, such as analytics and your CRM, then add more once you trust the setup.
What is the difference between an MCP server and a connector?
Many AI apps use "connector" for an MCP server you add from their directory. Under the hood it is usually the same thing: an MCP server, often hosted by the vendor, that you sign in to with OAuth.
Does the MCP Registry check servers for security?
As of October 2026, the registry's public repo describes namespace checks, so a listing under a company's name must be published by that company. It does not describe security scanning of the server code. You still need to do your own review.
