A third-party MCP server is safe to connect only after you have checked what it runs, what it can reach and how it handles tokens. A local server runs code on your machine with your privileges. A remote one receives your data and tokens. Review both as you would a supplier.
Local or remote matters most
The Model Context Protocol security guidance separates these cases. Local servers are binaries downloaded and executed on the same machine as the client. Without sandboxing and consent, risks include arbitrary code execution, no visibility into the commands run, and data exfiltration. The guidance says a client offering one click setup must show the exact command, mark it as potentially dangerous, and require explicit approval.
| Type | Main risk | First control |
|---|---|---|
| Local server | Code runs with your privileges | Read the startup command, run it sandboxed |
| Remote server | Data and tokens leave your control | Check scopes, hosting and data handling |
Checks for a local server
- Read the exact startup command before approving it, including arguments.
- Look for commands that touch your home directory, SSH keys or system folders, or that make network calls.
- Pin the package or binary to a version and verify where it comes from.
- Run it in a container or restricted profile with minimal file and network access.
- Prefer the stdio transport, which limits access to the client, and be wary of servers left listening on local ports.
Checks for a remote server
- Who operates it? Name, contact, location, and a security page.
- Scopes. The guidance warns against broad or omnibus scopes and recommends starting with a minimal set and elevating on demand. Decline a server that asks for everything at once.
- Token handling. The specification forbids token passthrough, where a server accepts tokens not issued to it and forwards them downstream. Ask whether the server validates the audience of tokens it receives.
- Consent. A server that acts as a proxy to another service should show its own consent page naming the client, scopes and redirect address.
- Logging. Can you see what tools were called, with what arguments?
Treat tool output as untrusted
A server can return text that tries to steer the model. Keep a human approval step for actions that write, delete or send, and limit which tools the agent can call.
Try it yourself
Open the MCP server setup demo to see how a server is connected and what you are asked to approve, and note which of the checks above apply at each step.
Click through it at your own pace, or open it full screen.
Quick check
Is a popular MCP server automatically safe?
No. Popularity says nothing about its permissions, its startup command or its token handling. Review each one.
Should every team be able to add MCP servers?
In most companies it is safer to keep an approved list and a review step, the same way you manage browser extensions.
Safeguard includes an MCP Guardrail and agent identity for governing which servers and tools agents can use, and a free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
