Is it safe to install MCP servers?
LAST UPDATED 2026-08-10
Not automatically, and not never — it depends entirely on the specific server. Independent audits have found the majority of tested MCP servers carry real, unaddressed vulnerabilities (command injection, path traversal, SSRF), so installing one without checking it first is a real risk. A server that's actually been audited, kept current, and reviewed by a human is a different proposition than an unmaintained one nobody has looked at — the risk lives in the specific server, not in MCP as a category.
The specific things to check yourself
Reading the full raw tool definitions (not your client's shortened summary), matching declared capability against actual capability, checking for a real provenance attestation, and checking freshness signals before trusting an old review — the full checklist is on its own page.
Read the full checklistAll concept explainers
What is MCP tool poisoning?
A tool's own description can carry instructions a user never sees — and an AI model reads it anyway.
What is an MCP rug pull attack?
The tool you approved isn't always the tool you're still running.
Are MCP servers vulnerable to SSRF?
A tool that fetches a URL on your behalf can be tricked into fetching the wrong one.
How do I know if an MCP server is abandoned?
A server that still installs fine can still be running code nobody's maintaining anymore.
MCP server security checklist
The specific things to actually check before you let a model call an MCP server's tools.
How do I vet MCP servers for enterprise use?
The individual-developer checklist isn't enough once a tool is running against production systems and real customer data.