MCP Server Risk Checklist: Vet a Server Before You Connect

Check a server

Answer from the server's docs, its repository or the vendor's security page. Unknowns become questions to ask.

1.Who publishes the server?

The product’s own company (official)A known community project, listed in the official MCP RegistryAn individual or a source I can’t verify

2.How does it run?

Remote, hosted by the vendor (a URL)Local, over stdio (the app starts it as a program)Local, but it opens a network port

3.How does it sign you in?

OAuth, with each person signing inA shared API key or personal access tokenNo sign-in at allNot sure

4.How much access does it ask for?

Only what the jobs need, or a read-only modeBroad or admin-level accessNot sure

5.What can its tools do?

Read onlyCreate or update records, or send messagesDelete, pay, deploy or change settings

6.Does it read content other people can write?

No: only our own structured dataYes: web pages, emails, tickets, documents or comments

7.Can you see what it did?

Yes: tool-call logs we can exportOnly what the AI app showsNo logs, or not sure

8.How is it updated?

Versioned releases we can pin, with a changelogIt updates itself, or we install the latest version every timeArchived, or no release in a long time

9.Where does your data end up?

It stays on our machines or in our own cloud accountWith the vendor, in a stated region with stated retentionNot stated

Based on our MCP server security review and vendor security questionnaire, which cite the MCP specification's security best practices and published advisories.

How to use it

How to use the MCP Server Risk Checklist

Pick the answer that fits each question. Where you don't know, choose not sure or skip it: unknowns are counted and turned into questions for the vendor.

Select Show risk notes. High-risk answers come first, each with what to do and the guide that explains it. Copy the vendor questions into an email, or send our full vendor questionnaire.

Limits

What it can't tell you

It is a first screen, not a security audit. It can't read the server's code, test it or look up known vulnerabilities. For that, follow the full process in our guide to security-reviewing an MCP server.

A good result doesn't make every use safe. The same server can be low risk for reading reports and high risk once it can send email. Check again when the server updates or you give it more access.

FAQ

Common questions

What makes an MCP server risky?

Mostly the access it has and the content it reads. A server with broad write access that also reads emails or web pages written by outsiders is the classic risky mix, because hidden instructions can steer the AI.

Is an official MCP server always safe?

No. Official means the product's own company publishes it, which helps with trust and upkeep, but you still need to limit its permissions and review its write tools.

What should I ask an MCP server vendor?

How users sign in, which scopes it needs, which tools write or delete, what it logs, how tool changes are announced and how to report vulnerabilities. The checklist builds that list from your answers.

Do local MCP servers need a review too?

Yes. A local server runs with your user account's access to files and the network, so read the full install command and check whether it opens a network port.

Next steps