MCP Security: How to Vet a Server Before You Install It

MCP security is the least talked-about of the four agentic attack surfaces, and it's also one of the easiest to skip past — installing a new tool for an agent often feels like flipping a switch, not making a security decision. But every MCP server or skill you connect is code you didn't write, running with your agent's own trust and reach. This guide covers what MCP is, why the supply-chain risk is different from a normal dependency, and what's worth checking before you install.

What is MCP, and why does it need its own security check

Model Context Protocol is an open standard that gives an AI agent a common way to connect to outside tools — a calendar, a database, a search engine, a company's internal system. Before MCP, every integration was custom and one-off. Now an agent can connect to any MCP-compatible server in minutes. That speed is the point, and it's also the risk: the same standard that makes connecting easy makes it easy to connect something you haven't actually vetted.

The supply-chain risk: clean today, poisoned tomorrow

The pattern security teams call a "rug pull" applies directly here. A server can pass your review clean — reasonable permissions, a legitimate-looking publisher, no red flags — and ship a malicious update months later, once enough agents depend on it that removing it is painful. Or the compromise happens further upstream, in a dependency the server itself relies on, without the publisher doing anything wrong. Either way, a one-time approval at install time doesn't cover the server's entire lifetime.

What's worth checking before you install a server or skill

1. Who publishes it, and can you verify that identity — not just a display name.
2. What permissions it actually requests versus what your agent's task needs.
3. Whether the version is pinned, or the server can silently update underneath you.
4. Whether it can read or write outside the scope it was installed for.
5. What track record or community signal exists beyond the publisher's own claims.
6. How fast you could revoke its access if something looked wrong tomorrow.

Quick self-check: which agent attack surfaces are you exposed on?

MCP and skill trust is one of four surfaces an agent gets compromised through. Check the boxes that apply to your agent to see, directionally, how many surfaces are live for you right now — this is a self-check, not a security audit.

MCP security and the agentic kill-chain

An untrusted or compromised MCP server is one of the most common ways an attack reaches an agent in the first place — either by directly executing malicious actions, or by feeding the agent content that carries a hidden instruction. See Prompt Injection: What It Is and How to Stop It for how that plays out once it's inside. And whatever a compromised server can do is bounded by the credentials the agent holds — see Non-Human Identity Security.

What a trust gate does — and doesn't do

If your agent also reads untrusted content, keeps memory, or holds credentials, MCP trust is one of four surfaces worth covering together. See the Agentic AI Security pillar and the Agentic AI Security Bundle for all four.