How to vet an MCP server before you install it (a 10-minute checklist)

MCP servers give your AI client (Claude Code, Cursor, VS Code and others) real powers: a shell, your files, a signed-in browser, your accounts. Installing one is closer to installing a browser extension with full permissions than to adding a library. Here's the short checklist I use before adding one.

The short answer

Check four things: who maintains it, exactly what it can touch, where its secrets will live, and whether it can change after you approve it. Then scan your own config and keep only servers whose install snippet comes from the maintainer's official README.

The checklist

1. Source and maintainer. Prefer the vendor's official repo or a well-known maintainer. Look at the license, the star count and the date of the last push.
2. Install snippet provenance. Copy the config from the official README, not from a blog post or a social media thread. A changed package name or URL in a copied snippet is the easiest supply-chain attack there is.
3. Capabilities. Note whether the server gets shell access, filesystem access or a signed-in browser profile. Those are the highest-risk permissions, because a manipulated prompt can reach your machine or accounts through them.
4. Secrets. Tokens in the env blocks of client configs sit readable on disk. mcp-audit (APIsec, MIT) has a scan command that looks for exposed API keys, tokens and database passwords across Claude Desktop, Cursor and VS Code configs.
5. Source code, for in-house or unknown servers. mcp-audit source-scan <path> flags the "prompt in, shell out" pattern: an LLM-controlled tool argument passed unsanitised into child_process.exec, subprocess.run(shell=True), os.system and similar. --exit-code lets you block merges on critical findings in CI.
6. Remote servers can change. A URL-based server can change its tools behind the same address after you connect. Prefer maintainers who publish versions or changelogs, and re-check from time to time.
7. Agent skills too. Skills bundled with a server are instructions your agent will follow. NVIDIA SkillSpector (Apache-2.0) scans Claude Code, Codex and MCP skills for prompt injection, data exfiltration and supply-chain risks before you install them.
8. Maintenance. An archived or stale repo is a signal. If the upstream is archived, look for the maintained successor.

FAQ

Is it safe to install MCP servers from GitHub? It depends on the server. Read what it can access, prefer official or widely used maintainers, copy the snippet from the official README and scan your setup for exposed secrets.

What's the riskiest MCP permission? Shell execution, followed by broad filesystem access and access to a signed-in browser.

How do I check an agent skill before installing it? Read its SKILL.md and any scripts it runs, then scan it with a tool such as SkillSpector.

I keep a free, curated directory of MCP servers, agent skills and stacks where each listing links its upstream repo, license and last push, and copies install snippets verbatim from the official README with the date of the check: Stack Registry. The full version of this checklist lives here.

What do you check before adding a server? I'd like to hear what I'm missing.