It can be, if you treat it like any program you download and run. A local MCP server is code with the same privileges as the client that launches it. Read the exact command, check where the package comes from, run it in a sandbox, give it least access and watch what tools it exposes.
Definitions
Local MCP server. A program started on your machine, usually through a command in a config file, that talks to the client over stdio.
Remote MCP server. A hosted service reached over HTTP, with its own tokens and its own operator.
Launch command. The command stored in config, such as an npx or uvx invocation, that downloads and runs the server.
Risk by type
| Type | Main risk | First control |
|---|---|---|
| Local, package from a registry | Malicious or compromised package | Verify the publisher, pin the version |
| Local, from a repository | Code you have not read | Read it or run it sandboxed |
| Remote, run by a vendor | Data you send to a third party | Check scopes, data terms and logging |
| Remote, run by you | Your own misconfiguration | Token audience checks, access control |
Vetting steps
- Read the full launch command. The MCP security guidance says clients should show the exact command without truncation and warn that it executes code. Look for sudo, deletion commands, network calls and access to home directory paths.
- Check the source. Find the repository, the maintainers and the recent history. Be cautious about names that resemble well known packages.
- Pin the version. A floating latest tag lets a later release change behavior. Update on purpose after review.
- Run it in a sandbox. The guidance recommends containers or application sandboxes with restricted file, network and system access, with explicit grants when needed.
- Prefer stdio for local use so other processes cannot reach it, or require a token if you use HTTP on localhost.
- Limit credentials. Give the server a token with the smallest scope and keep it out of git.
- Review the tools it exposes. Read each tool name and description. Treat tool annotations as untrusted unless they come from a server you trust, as the specification says.
- Keep human approval on. Do not auto approve tools from a server you have just added.
- Record it. Add the server to an inventory with an owner, the version and the date you reviewed it.
Vendor stance worth knowing
Anthropic's Claude Code documentation encourages writing your own MCP servers or using ones from providers you trust, and says Anthropic does not security-audit or manage any MCP server. That applies generally: a directory listing is not a guarantee.
Try it yourself
Click through it at your own pace, or open it full screen. Notice what the connection step asks you to approve.
Quick check
Can an MCP server steal my files?
A local server runs with your user's privileges, so it can read what you can read unless a sandbox or permission layer stops it. That is why sandboxing and least access matter.
Is a popular server safe because many people use it?
Popularity is not a review. Packages get compromised after they become popular. Pin versions and review updates.
What about servers inside a repository's config file?
Treat a project config that adds servers like code from the repository. Review it before trusting the folder.
Where Safeguard fits
Safeguard scans the packages behind a server for known vulnerabilities, offers an MCP Guardrail and asset discovery to help find which servers are in use, and provides a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
