"Works with MCP" tells you only that a product speaks some part of the Model Context Protocol. It does not say whether it is a client or a server, which transport it uses, how it authorizes, or which tools it exposes. Ask those four things, then compare the answers with the specification.
Four things the badge hides
| Question | Why it matters | What to ask |
|---|---|---|
| Client or server? | A client connects to servers; a server exposes tools. Risks differ. | "Which role does the product play?" |
| Which transport? | Local stdio and remote HTTP have different exposure | "How does it connect?" |
| How does it authorize? | Tokens must be issued to the server that receives them | "What tokens does it accept and validate?" |
| Which tools? | Each tool is capability an agent can use | "List every tool with its inputs and effect" |
Client or server
If the product is an MCP client, ask how it handles approval. The specification says there should always be a human in the loop with the ability to deny tool invocations, and that clients should show tool inputs before calling the server. If it is a server, ask what it can reach and under whose authority it acts.
Transport
A local server started over stdio runs on the user's machine with that user's privileges. The security guidance warns that local servers can execute arbitrary commands, and clients must show the exact command before connecting one. A remote server raises different questions about authentication, sessions and what data crosses the network. See local versus remote MCP servers.
Authorization
The specification states that MCP servers must not accept tokens not explicitly issued for them, and that servers must not use sessions for authentication. Ask the vendor to explain how its product meets each. A vague answer is a finding.
Tools
Ask for the full tool list. Each tool should have a clear name, a precise description, a defined input schema and a stated effect. The specification says clients must treat tool annotations as untrusted unless they come from trusted servers, so do not accept a description such as "read only" as proof.
A one page request
Send this to any vendor claiming MCP support:
- Role: client, server or both
- Transports supported
- Authorization method and token validation
- Complete tool list and effects
- Behaviour when the tool list changes
- Logs available for tool calls
- Version of the specification followed
Compare the answers across vendors in one table.
Try it yourself
Click through it at your own pace, or open it full screen.
Note each choice you make during setup, such as which client and which connection method, since those are the details a badge leaves out.
Safeguard includes an MCP Guardrail as a GA capability, and the free scan is available without setup.
Quick check
Is MCP support a security feature?
No. It is an integration feature. Security depends on how the product handles tokens, approvals and tools.
Which specification version should a vendor follow?
Ask which version they follow and check it against the current published specification, since it is revised over time.
Sources
Last reviewed: 19 October 2026.
