Before you one-click install an MCP server, read the exact command it will run, check the package and publisher, understand that it runs with your privileges, and prefer a sandbox with limited folders and network. The MCP security guidance says clients must show the full command and ask for explicit approval first.
Why a local server is a big decision
A local MCP server is a program that runs on your machine with the same rights as the client. The spec's security guidance lists three ways this goes wrong: a malicious startup command hidden in a configuration, a malicious payload inside the server itself, and an unsafe local server left reachable from a web page through DNS rebinding.
The risks it names are arbitrary code execution, no visibility into the commands, obfuscated commands, data exfiltration and data loss.
What a good install prompt shows
The spec says a client that supports one-click setup must show the exact command without truncation, label it as a potentially dangerous operation that runs code, require explicit approval and let you cancel. If your client shows only a server name and an install button, treat that as a gap.
Your five minute check
- Read the command. Look at the whole line, including arguments and anything after an and sign or a pipe.
- Find the package. Open it in its registry. Check the publisher, release history and linked repository.
- Check for scary patterns. The spec flags sudo, recursive deletes, network calls and file access outside expected folders.
- Check what it touches. Home directory, SSH keys and system folders are red flags.
- Decide the sandbox. Container or application sandbox, narrow mounts, no network unless needed.
Safer defaults
| Choice | Safer option |
|---|---|
| Transport | stdio limits access to the client, per the spec |
| HTTP on localhost | Require an authorization token or use a restricted socket |
| Credentials | Environment or vault, scoped to the task |
| Version | Pin it, avoid always latest |
| Updates | Review the diff and the tool list |
After you install
Re-check the tool list after updates, since a server can add tools later. Log what it does. Remove it when the project ends.
Safeguard includes policies, gates and guardrails for agent and tool access, and a free scan at https://gold.safeguard.sh/scan.
Try it yourself
Step through the setup and pause at the point where you would approve a server, then ask what you would want to see on that screen.
Click through it at your own pace, or open it full screen.
Quick check
Is a signed or popular server automatically safe?
No. Popularity and signing help you judge who published it, but the server still runs with your privileges, so sandbox it anyway.
Does stdio make a server safe?
It limits who can talk to the server, but the server itself still runs on your machine with your rights.
Sources
Last reviewed: 19 October 2026.
