PlugWiki

MCP security: risks and how to stay safe

The four real MCP risks, a five-minute checklist before you connect a server, and the lowest-risk servers we cover.

Picks
8
ranked

MCP servers are as safe as the access you give them and the content they read. The real risks are tricks hidden in text the AI reads (prompt injection), keys that reach far more than the task needs, tool descriptions that carry hidden instructions (tool poisoning), and fake copies of popular servers. Use the official server, the narrowest access that works, and keep approvals on.

A server acts with your account's permissions, so the AI can do anything that account can. Local servers run as programs on your computer with your user's rights. Every server page on PlugWiki has a Permissions section with its risk level, what it can read, change and delete, whether it has a read-only mode, and any published security advisories.

Good for

  • Anyone about to connect an app to Claude, ChatGPT or Cursor
  • Developers running local MCP servers in Claude Code or Cursor
  • Security and IT teams approving MCP servers for a company
  • People installing Agent Skills from other authors

Top picks

Official servers rated low risk in the Permissions section of their PlugWiki page, with no security advisories listed there as of 2026-11-01, ordered by GitHub stars where they have a public repo. This summarizes public data on each page; it is not a security audit or certification.

  1. 1Context7 logo
    Context7Read-onlyOfficialHosted or LocalAPI key

    It only reads library docs. The one thing to watch is that docs come from community submissions and could carry hidden instructions.

    LowRisk
  2. 2Perplexity MCP Server logo
    Perplexity MCP ServerRead-onlyOfficialHosted or LocalOAuth

    It only searches the web. The main risk is cost, so set a spending limit on the API account.

    LowRisk
  3. 3
    MorningstarRead-onlyOfficialHostedOAuth

    Every tool only reads Morningstar data, and you see only what your license allows.

    LowRisk
  4. 4
    GoDaddy MCP ServerRead-onlyOfficialHostedNo sign-in

    It only looks up public domain data, so it cannot buy, change or delete anything.

    LowRisk
  5. 5
    Google Ads MCP serverRead-onlyOfficialLocalOAuth

    It cannot change campaigns or budgets. The worst case is your ad data reaching the AI app you connect.

    LowRisk
  6. 6
    Gong MCP ServerRead-onlyOfficialHostedOAuth

    It cannot change anything in Gong. Call and email summaries do leave Gong for the AI app, so check your policy.

    LowRisk
  7. 7
    GranolaCannot deleteOfficialHostedOAuth

    It cannot delete notes. Your meeting notes and transcripts do go to the AI app you connect.

    LowRisk
  8. 8
    Elastic Agent Builder MCP ServerRead-only built-insOfficialHostedAPI key

    Its built-in tools only read. Use an API key limited to the indices you need, with an expiry date.

    LowRisk

Check an MCP server before you connect it

  1. 1

    Confirm it is the official server

    Get the address or package name from the vendor's own docs, not from a search result or a directory listing. Fake copies with the real name exist: in September 2025 a copy of Postmark's server on npm added a backdoor that secretly BCC'd the emails it sent to an outside server. Each of our server pages says whether a server is official.

  2. 2

    Prefer sign-in over pasted keys

    A hosted server you sign in to, like Notion or Linear, only gets the access you approve on the sign-in screen, and you can revoke it in that app. A pasted API key often reaches everything your account can.

  3. 3

    Make the key as narrow as you can

    If you must use a key or token, create one just for the AI. Limit it to the projects or repos it needs, read-only where possible, with an expiry date. A broad token that leaks gives an attacker everything at once.

  4. 4

    Turn on read-only mode if the server has one

    Many servers can run read-only, such as Supabase and GitHub. Each server page's Permissions section says whether it has a read-only switch and how to turn it on. For databases, also connect with a database user that can only read.

    Uses Supabase, GitHub MCP Server

  5. 5

    Do not mix private data, untrusted content and sending

    The risky combination is a setup that can read your private data, read content anyone can write (web pages, emails, public issues), and send data out. Text in that content can carry hidden instructions the AI may follow. If you need all three, keep approvals on for every send or write.

  6. 6

    Keep approvals on and read each tool call

    Leave your client's ask-before-running setting on, at least for tools that write, delete or send. Read the tool name and the inputs before you approve. OpenAI's own docs warn that a wrong write action can destroy, change or share data.

    Prompt
    List every tool you can use right now, grouped by server, and mark which ones can change, delete or send data.
  7. 7

    Check for advisories and update

    Look at the Security advisories part of the server's page on PlugWiki before you install, and update local servers when a fix ships. A server can change after you approve it, so re-check after updates. Teams can route servers through an MCP gateway to keep an approved list and a log of every call.

How we ranked these

Only servers whose page rates them low risk are listed, ordered by GitHub stars where they have a public repo. The list is built from the data on each server page, not from a security audit by PlugWiki.

CriterionWeightHow it is measured
Official30%Published by the company behind the app.
Low risk on its page40%The Permissions section of the server's approved page rates it low: it cannot change or delete data, or only in small, reversible ways.
No published advisories20%The Security advisories part of the server's page lists none (OSV and GitHub advisories, as of 2026-11-01).
Popularity10%GitHub stars, used only to order servers that pass the checks above.

Data as of 2026-11-02

Questions

Is MCP safe?

It can be, if you choose servers carefully. The protocol itself is open and documented, but each server can do whatever its account or token can. Use official servers, narrow access and read-only mode, and keep approvals on.

What is prompt injection in MCP?

Hidden instructions inside content the AI reads, such as a web page, email or issue. If the AI follows them, it may misuse your other tools, for example to send private data out. Claude Code's docs warn that servers which fetch outside content expose you to this.

What is tool poisoning?

A server hides instructions for the AI inside its tool descriptions, which you do not normally see. Security firm Invariant Labs described it in April 2025. A server can also change its descriptions after you approve it, so update only servers you trust.

Have there been real malicious MCP servers?

Yes. In September 2025 a fake postmark-mcp package on npm, not made by Postmark, added a backdoor in version 1.0.16 that secretly BCC'd emails to an outside server. Always install from the vendor's own instructions.

What are MCP security best practices?

Use official servers. Prefer sign-in to pasted keys, and keep keys narrow. Turn on read-only mode, keep approvals on for writes, and update local servers when fixes ship. Teams should also keep an approved list and log tool calls.

Are local MCP servers riskier than hosted ones?

They carry a different risk. A local server is a program running on your computer with your user's rights, so a bad one can read files or run commands. A hosted server cannot touch your computer but holds access to your online account.

Can an MCP server delete my data?

Yes, if it has write tools and the account allows it. Each server page's Permissions section shows whether it can delete, and whether a read-only mode exists. Read every delete or send before you approve it.

Which MCP servers need the most care?

Servers that can change real data or drive a browser. On our pages GitHub, Supabase and Playwright are rated high risk. Chrome DevTools is rated medium and has four published advisories, all fixed, and Metabase is rated medium because it can run raw SQL and send data by email or Slack. Use their read-only or isolated modes and keep them updated.

How do I scan an MCP server for security issues?

Start with the basics a scanner would check. Confirm the publisher, read the tool list and descriptions, check published advisories, and run local servers in a container. Docker MCP Gateway runs each server in its own container.

Are Agent Skills a security risk?

They can be. A skill can tell the AI to run code or call tools, so a malicious one could leak data. Anthropic advises using skills you wrote or got from Anthropic, and reading every file in any other skill first.

Does an MCP gateway make servers safe?

It helps a team, not a single risky server. A gateway gives one place to approve servers, limit tools and log calls. Each server still needs a narrow token. See our gateway comparison.

Sources

Docs, issue trackers and discussions this page is built from.

Show all 10
  1. Connect Claude Code to tools via MCP · code.claude.com
  2. Security Best Practices · modelcontextprotocol.io
  3. MCP Security Notification: Tool Poisoning Attacks · invariantlabs.ai
  4. Postmark MCP server code hijacked · theregister.com
  5. Use connectors to extend Claude's capabilities · support.claude.com
  6. Tools (specification) · modelcontextprotocol.io
  7. The lethal trifecta for AI agents · simonwillison.net
  8. Add custom MCP server · developers.openai.com
  9. MCP Gateway · docs.docker.com
  10. Agent Skills · platform.claude.com

Updated Nov 1, 2026.

MCP Security: Risks, Best Practices and Safer Servers | PlugWiki