MCP Server Security Risks and How to Review Your Config

MCP servers are programs that give an AI app new tools, so a local server can run code with your user rights. The main risks are unsafe startup commands, malicious packages, prompt injection through content the AI reads, and broad tokens. Review each server's command, source, keys and tool access before you trust it.

The Model Context Protocol, or MCP, is an open standard that connects AI apps to outside tools and data. It is useful, and it also widens what an AI app can do on your behalf. This guide explains the risks in plain terms and gives you a review you can finish in one sitting.

Why MCP servers carry risk

The MCP specification is direct on this point. It says tools represent arbitrary code execution and should be handled with care. It also says tool descriptions should be treated as untrusted unless they come from a server you trust. The protocol itself cannot enforce these rules, so the work falls on the app you use and on you.

Command execution

A local server starts from a line in a config file. The app runs that command on your machine. The official MCP security best practices describe three ways this goes wrong:

A bad startup command is placed in a client config.
A harmful payload ships inside the server itself.
An insecure local server left running on localhost is reached through DNS rebinding.

The same document notes that a local server runs with the privileges of the client. So a server you added for one small task may be able to read your SSH keys, your documents and your other project folders.

Prompt injection

Prompt injection means text changes how the model behaves. The indirect form is the one to watch with MCP. OWASP's prompt injection entry describes a model taking in outside content, such as a website or a file, that alters its behavior.

Think about an agent with an email tool and a file tool. A message it reads could contain hidden instructions to send a private file somewhere. The risk is highest when one agent has all three of these: private data, untrusted content, and a way to send data out. OWASP says no method reliably prevents prompt injection, so plan to limit the damage.

Tokens and scopes

Servers that connect to GitHub, Slack, a database or a cloud account usually hold a token. If that token has wide scopes, a stolen token or a confused agent can do wide harm. The MCP guidance warns against wildcard scopes and against bundling unrelated rights together.

Where MCP configs live

Start by finding every config on your machine. Common locations include:

Claude Desktop on Mac: ~/Library/Application Support/Claude/claude_desktop_config.json
Claude Desktop on Windows: %APPDATA%\Claude\claude_desktop_config.json
Claude Code: ~/.claude.json for personal servers, and .mcp.json in a project folder for shared ones
Cursor: ~/.cursor/mcp.json for global servers, and .cursor/mcp.json in a project folder
VS Code: .vscode/mcp.json in a project folder. For your personal file, run MCP: Open User Configuration from the Command Palette

Tools change these locations over time, so check the docs for your version. To open the Claude Desktop file from the app, go to Claude > Settings > Developer > Edit Config, as shown in the local server guide.

How to review your MCP config

Open each file and go through it one server at a time.

List every server. Look under mcpServers, or servers in VS Code files. If you do not recognize a name, or no longer use it, remove it.
Read the full command. Look at command and every item in args. Be careful with sudo, curl, rm, bash -c, encoded text, and long chained commands.
Check the source. Find the package or repository the command uses. Confirm who publishes it, and look for a real project with readable code. Watch for names that are one letter off from a well known package.
Pin the version. A command such as npx -y some-package fetches whatever is current when it runs. Pin an exact version, such as some-package@1.2.3, so an update does not reach you without a review.
Move keys out of the file. Check every env and headers block. If you see a token in plain text, replace it. VS Code supports ${input:variable-id} values that prompt you once and store the value securely. VS Code's MCP reference warns that a personal config file is not a secret store.
Limit paths. If a filesystem server takes a list of folders, give it one project folder. Do not give it your home folder.
Reduce token scopes. Use read-only tokens when the task only reads. Use a separate token for each server, so you can revoke one without touching the others.
Review remote servers. For an entry with a url, confirm the domain, use HTTPS, and read the scopes on the consent screen before you approve.
Restart the app. Many apps load servers only at startup, so changes need a restart.

If you have many projects, one way to check this quickly is Prycheck. It is a local app that finds MCP and agent configs on your device and sends nothing anywhere. It shows what is set up, not what a server actually does or sends, so reading the config still matters.

How to reduce risk day to day

Keep approvals on. The spec says hosts must get your consent before calling a tool. Avoid modes that approve every tool call without asking.
Read the prompt. When the app shows a tool call, look at the arguments as well as the tool name.
Split risky tools. Avoid connecting a tool that reads untrusted web content in the same session as one with private data and outbound access.
Be careful with cloned projects. A shared project can bring its own MCP config. Claude Code asks you to approve servers from .mcp.json, and VS Code ties workspace servers to Workspace Trust. Read the file before you approve it.
Sandbox where you can. Run servers you are unsure about in a container or a virtual machine with limited file and network access.
Use stdio for local servers. The MCP guidance prefers it, since it limits access to the client. A local HTTP server should require a token.
Review after updates. Check tool lists again after a server updates, since tools and descriptions can change.

What to do if something looks wrong

Remove the server from the config and restart the app.
Stop any process it left running.
Revoke every token the server could read, then create new ones.
Review recent activity in the accounts it could reach, such as commits, messages and file changes.
If you think the machine itself is compromised, follow your normal incident process and use proper security tools.

Frequently asked questions

Are MCP servers safe to use?

They can be, if you treat each one like software you install. A local server can run code with your rights, so use trusted sources, pinned versions, small scopes and tool approvals.

What is the difference between a local and a remote MCP server?

A local server runs on your machine and can touch your files and processes. A remote server runs elsewhere and connects over the network, so the main questions are who runs it, what scopes it holds and what data it receives.

Can I fully prevent prompt injection in an agent?

No. OWASP says no method reliably prevents it. You can reduce the impact with small permissions, human approval for risky actions and clear separation of untrusted content.