MCP server security: risks, malicious servers and how to vet one

Or let the Botlens skill do the first pass for you.

Last checked: 2026-11-01 · How Botlens checks listings: a rule-based scan of public instructions and code, with coverage recorded per listing.

Securing an MCP server comes down to what the server's tools can reach. A server runs code and hands your agent new tools, so the main risks are key theft, hidden network uploads, shell access and tool descriptions that steer the agent. Read the tool list and code, pin the version, and keep approvals on.

What is MCP server security?

It is about making sure a server your agent connects to does only what it says. An MCP server runs code and gives your agent a set of tools. A skill is mostly instructions. Both run with your permissions, but an MCP server can act every time the agent calls one of its tools.

What are the main MCP server security risks?

The main risks are access the job does not need, data leaving your machine, and instructions hidden where the model will read them.

Key and file access. A server may read environment variables or key files beyond the one key it needs.
Unexpected network calls. Data can go to a host that has nothing to do with the service.
Shell and file writes. Running commands or writing outside its own folder gives it a lot of reach.
Tool descriptions as instructions. The model reads tool descriptions as context, so a description can tell the agent to skip asking you or hide what it does.
Silent updates. A new release can change the tool list after you approved the old one.

None of these is proof of bad intent. A sync tool uploads data because that is its job. The point is to know before you install. For how injected instructions reach agents in general, see Prompt injection in agent skills.

How do you spot a malicious MCP server?

You spot one by comparing what it says it does with what its code and tool list can do. A gap between the two is the main warning sign. Other signs:

The source code is not public, so nobody can check it.
Tools reach far beyond the stated job, such as a weather server that can read files.
Tool descriptions tell the agent to skip confirmation or trust outside content.
Network calls go to hosts that do not match the service.
The README asks you to paste keys into chat or run a remote script in your shell.

How to vet an MCP server before you install it

One checklist, in order. If you cannot read code, steps 1 and 8 alone are often enough reason to skip.

Find the source. If there is no public repository or the instructions are not public, nobody can check it. That is the case for 18,071 of the listings on Botlens. Treat no source as a reason to slow down.
List the tools. Each tool is a thing your agent can now do. Remove servers whose tools go far beyond the job.
Read the instructions and tool descriptions as text the agent obeys. For a skill that is usually SKILL.md; for an MCP server, the README and the tool definitions. Watch for lines that tell the agent to skip confirmation, hide actions or follow text from web pages or emails.
Check how keys are handled. The server should read only the keys it needs, from where its README says. Look for environment variables and key files (process.env, os.environ, ~/.ssh).
Check where it connects. Every outbound host should match the service.
Look for shell and file access. Shell execution (exec, spawn, subprocess), curl … | sh style remote installs and writes outside its folder need a clear reason.
Check for sending without approval. Email or messages sent without an approval step are a warning sign. Each of these can be legitimate; the question is whether it fits the job.
Check permissions against purpose. A summariser that wants write access to your whole drive is a mismatch. Overly broad permissions are one of the reasons Botlens gives a Caution badge. Prefer read-only modes or narrow scopes when offered.
Pin the version. Install a specific release or commit, not "latest", and review changes before updating. Botlens records the commit and a SHA-256 for every scanned listing so you can compare.
Keep approvals on. Let your agent ask before tools that send, delete or pay.

Is there an MCP server security scanner?

Yes, in the sense of rule-based scans. Botlens runs a static scan on each listing it can read, including MCP servers, looking for broad risk classes like credential access, unexpected uploads and shell execution. A scanner is a first filter. It cannot read closed code, so treat its result as a reason to look closer, not a final answer.

What if the MCP server is closed source?

Then nobody outside the author can check it. Botlens marks such listings Unscanned. Across the catalog, 18,071 of 30,757 listings are Unscanned, next to 11,517 marked Safe. Treat closed code as a reason to wait or pick an open alternative.

Let Botlens pick for you

Yes. Botlens is a free catalog of Grok Bot bots, templates and skills that shows each listing's safety status, and it ships a Grok Bot skill that picks them for you. Describe your task and the skill searches the catalog, skips listings flagged Risky, ranks matches by fit and safety, and asks before installing anything. You don't have to test bots by hand.

Botlens shows each listing's badge: 11,517 Safe and 18,071 Unscanned of 30,757 listings. See How to find the right AI bots and skills automatically.

FAQ

What are the biggest MCP server security risks?

The biggest are reading keys or files the job does not need, sending data to unexpected hosts, running shell commands, and tool descriptions that quietly steer the agent. Updates can also change a server after you approved it. Read the tool list and code, and pin the version you checked.

How can I tell if an MCP server is malicious?

Compare what a server claims with what its code and tools can do. A malicious MCP server often asks for more access than its job needs, connects to unrelated hosts, or has tool descriptions telling the agent to skip confirmation. If the source is closed, you cannot tell, so treat it as unverified.

What are MCP server security best practices?

List the tools and remove anything beyond the job. Read tool descriptions as instructions the model will follow. Check key handling, outbound hosts and shell access in the code. Start read-only, pin the version, and keep approvals on for any tool that sends, deletes or pays.

Does an MCP server security scanner make a server safe?

No. A scanner finds common risky patterns in code it can read. It cannot read closed code, and it can miss unusual tricks. Botlens badges work the same way: Safe means no obvious threats were found in what was read. Use a scan as a filter, then review permissions yourself.

FAQ

Is an MCP server different from a skill?

Yes. An MCP server is a running program that exposes tools; a skill is mostly instructions and optional scripts. Both run with your agent’s permissions, so the same checks apply.

What if I cannot read code?

Start with step 1 and step 4. No public source plus broad permissions is enough reason to skip.