The inspection found no issues.
MCP Security
MCP Security: server risks and adoption checklist
MCP security is the practice of controlling which servers an AI system may use, what permissions they receive, and where their data and actions can go.
The review extends beyond encrypted transport to provenance, description-to-implementation consistency, runtime, credentials, outbound connections, and behavior after updates. Name and popularity are not security evidence.
Abcas MCP Guard is a public-benefit database that continuously collects and inspects public MCP servers and keeps adoption evidence up to date.
Last reviewed: July 22, 2026
Primary risks
How MCP expands the attack surface
MCP extends an AI system from generating responses to operating files, services, and tools. The server, its tools, data, credentials, and update path all become security boundaries.
Provenance and dependenciesImpersonated publishers, compromised packages, or tampered updates can enter an environment under a legitimate-looking server name.
Tool descriptions and instructionsInstructions hidden in tool descriptions or retrieved content can influence an AI system and trigger actions the user did not intend.
Excessive permissionsBroad access to files, shells, cloud control planes, or databases increases the impact of mistakes and compromise.
CredentialsAPI keys and OAuth tokens can leak through logs, outbound requests, child processes, or an overly broad server configuration.
Outbound data transferPrompts, files, or internal data may be sent to destinations that were not clear from the server description.
Post-update behavior changesA server or dependency update can change permissions, destinations, and tool behavior after the original review.
Pre-adoption review
Six checks before connecting a server
Do not classify a server by name alone. Separate verified evidence from the parts that remain unknown, then decide the permitted boundary.
PublisherCan you connect the official website, package registry, public repository, signatures, and maintainers to the same publisher?
Description and implementationDo the actual tools, code, dependencies, and destinations match the server description and intended use?
Runtime and transportDoes the server run through stdio, HTTP, a local process, or a remote service, and where is that boundary enforced?
Permissions and mutationsWhich read, write, delete, command execution, or administrative operations are actually required?
Credentials and destinationsAre credential storage, outbound destinations, and third-party data sharing clearly documented and limited?
Inspection scope and updatesWhat was inspected, what could not be inspected, and has the server or a dependency changed since the last review?
Public evidence
Inspection evidence published by MCP Guard
MCP Guard publishes the current Public Registry count, total inspection attempts including failures, the restricted-use/prohibited share of inspectable MCP servers, the NEED_REVIEW share of classified public MCP servers, the number of checks in its patent-pending inspection method, and the latest update time. Every figure comes from the same public API and refreshes once per minute.
Public MCP servers
Loading
MCP servers currently published in the Public Registry
Total inspection attempts (including failures)
Loading
Cumulative actual inspection attempts, including failed attempts
Restricted-use / prohibited rate
Loading
(RESTRICT + BLOCK) / (PASS + WARN + RESTRICT + BLOCK). Unable-to-determine rows are excluded
Unable-to-determine rate
Loading
NEED_REVIEW / (PASS + WARN + RESTRICT + BLOCK + NEED_REVIEW). Reported separately from risk
Inspection checks
Loading
Total checks in the patent-pending MCP inspection method
Last updated
Loading
Decision and operation
How to act on review results
A single score should not declare a server safe. Match the intended use to the available evidence and choose an appropriate access boundary.
How to read inspection results
PASS, WARN, RESTRICT, and BLOCK are ordered by how strictly use must be controlled. NEED_REVIEW is separate: the available evidence was insufficient to determine safety.
The inspection found items that require caution.
The inspection found high-risk behavior, permissions, or vulnerabilities. Use only after every required technical control is enforced and verified.
The inspection met high-impact prohibition criteria. Do not use this server.
Separate from the risk scale
NEED_REVIEWUnable to determine
The available evidence was insufficient, so safety could not be determined.
Continuous review after adoptionFor every inspection result, review tool lists, permissions, external connections, and behavior again after server or dependency updates.
Frequently asked questions
MCP security fundamentals
What is MCP security?
MCP security is the practice of reviewing and controlling server provenance, runtime, permissions, credentials, external connections, and post-update behavior when an AI system connects to tools or data through the Model Context Protocol.
Is a popular MCP server automatically safe?
No. Popularity does not verify the publisher, implementation, permission scope, outbound data flow, or future updates. Each server still needs an adoption review.
Do HTTPS and OAuth make an MCP server safe?
They protect parts of transport and authentication, but they do not prevent excessive tool permissions, malicious tool descriptions, compromised dependencies, unexpected data transfer, or behavior changes after an update.
Does a PASS result guarantee that a server is safe?
No. It means no issue was found within the evidence and inspection scope available at that time. Reinspection is needed when the server or its dependencies change.
What is the difference between Free and Pro access?
Signed-in Free users can search simplified information for every MCP server. Pro adds inspection evidence, CSV and JSON exports, update-drift review, and local monitoring tools.
References
Public security guidance
Use MCP Guard inspection evidence alongside public security guidance from the MCP project, OWASP, and the NSA.
Related guides
Checks by environment and risk
Continue with focused checks for stdio, runtime monitoring, Claude, Cursor, Codex, and other adoption contexts.
Product and technical documentationMCP basics, inspection technology, statuses, and Free / Pro coverageMCP scan comparisonHow pre-adoption inspection and monitoring differ from scan-only productsMCP STDIO/RCELocal process, stdio, and command execution reviewMCP runtime guardPost-update drift, dangerous operations, and Local Agent coverageMCP server checklistSource, permissions, destinations, and data-transfer scopeMCP server riskPermissions, inputs, operations, and prompt-injection exposureSafe MCP listFields for managing approved MCP candidates in a teamClaude Code MCP securityPre-adoption review fields for Claude CodeClaude MCP setup reviewConfiguration review for Claude Desktop and Claude CodeCursor MCP securityPre-adoption review fields for CursorCodex MCP securityBoundary review for CLI agents using MCPResearch BlogPublic Registry observations for MCP adoption review
Technical documentation
MCP Server DB
Research Blog