MCP security checklist: 9 checks before you install a server

A practical security checklist for MCP servers: trust, version pinning, least privilege, secrets, prompt injection and tool poisoning.

Why it matters

An MCP server runs with your permissions, and whatever its tools return goes straight to the model. Check these points before you install one.

Source. Prefer official or well-known maintainers, recent commits and many users. Read the code if it is small.
Pin versions. Use a fixed package version instead of “latest” so an update cannot silently change behaviour.
Least privilege. Give file servers one folder, database servers a read-only user and API tokens the narrowest scopes.
Secrets. Keep keys in environment variables or your client’s secret storage, never in a shared repository.
Prompt injection. Web pages, issues and emails that a tool reads can contain hidden instructions. Keep confirmation on for tools that write, send or delete.
Tool poisoning. The model also reads a server’s tool descriptions, and malicious ones can steer it. Review what a server exposes.
Remote servers. Use HTTPS and OAuth where offered, and connect only to providers you trust.
Isolation. Run untrusted servers in a container or virtual machine.
Clean up. Remove servers you no longer use.