Claude Code MCP security
Using MCP Servers Safely with Claude Code
Adding an MCP server to Claude Code brings a terminal-based AI agent closer to files, Git, commands, and external APIs. Scan before adoption, then design the control scope separately for the MCP client, OS or container, and connected service.
Permissions to review first
Claude Code operates in a development context, so the impact of an MCP server’s permissions can be greater than for ordinary web integrations.
- File reads and writes
- Arbitrary command execution
- Git operations
- Access to API tokens and environment variables
Do not stop at a safe verdict
Even when an adoption-time inspection finds no issue, behavior can change through updates, dependencies, external input, or operations initiated through prompts.
- Rescan after updates
- Compare declared and implemented behavior
- Confirm required restrictions before connecting
- Restrictions at the OS and connected service
What to check with MCP Guard
Abcas MCP Guard shows public MCP statuses and connection conditions. Pro provides detailed inspection evidence. Required restrictions are enforced by the MCP client, OS or container, gateway, and provider service.
- Free pre-connection checks
- Source analysis and dynamic inspection
- Provenance and inspection evidence
- Confirm required restrictions before connecting
What Abcas MCP Guard can do
Full inspection procedure catalog
25
Baseline procedures for local MCP
22
Baseline procedures for public HTTPS
13
Applicable procedures and evidence that can be obtained vary by target. The counts for operation, dependency review, and consistency review categories (18 / 4 / 17) help organize the observations.
MCP vulnerabilities and checks before connecting →