The inspection found no issues.
MCP Security
MCP Vulnerabilities and Security: Risks to Check Before Connection
MCP vulnerabilities arise from flaws or weaknesses in servers, clients, and dependencies. When MCP server vulnerabilities are exploited, they can lead to unauthorized actions or data exposure. Before connecting, review vulnerabilities alongside adoption risks such as publisher provenance, permissions, credentials, and outbound data transfer.
The review extends beyond encrypted transport to provenance, description-to-implementation consistency, runtime, credentials, outbound connections, and behavior after updates. Name and popularity are not security evidence.
Abcas MCP Guard is a public-benefit database that continuously collects and inspects public MCP servers and keeps adoption evidence up to date.
Last reviewed: September 17, 2026
Primary risks
How MCP expands the attack surface
MCP extends an AI system from generating responses to operating files, services, and tools. The server, its tools, data, credentials, and update path all become security boundaries.
Provenance and dependenciesImpersonated publishers, compromised packages, or tampered updates can enter an environment under a legitimate-looking server name.
Tool descriptions and instructionsInstructions hidden in tool descriptions or retrieved content can influence an AI system and trigger actions the user did not intend.
Excessive permissionsBroad access to files, shells, cloud control planes, or databases increases the impact of mistakes and compromise.
CredentialsAPI keys and OAuth tokens can leak through logs, outbound requests, child processes, or an overly broad server configuration.
Outbound data transferPrompts, files, or internal data may be sent to destinations that were not clear from the server description.
Post-update behavior changesA server or dependency update can change permissions, destinations, and tool behavior after the original review.
Pre-adoption review
Six checks before connecting a server
Do not classify a server by name alone. Separate verified evidence from the parts that remain unknown, then decide the permitted boundary.
PublisherCan you connect the official website, package registry, public repository, signatures, and maintainers to the same publisher?
Description and implementationDo the actual tools, code, dependencies, and destinations match the server description and intended use?
Runtime and transportDoes the server run through stdio, HTTP, a local process, or a remote service, and where is that boundary enforced?
Permissions and mutationsWhich read, write, delete, command execution, or administrative operations are actually required?
Credentials and destinationsAre credential storage, outbound destinations, and third-party data sharing clearly documented and limited?
Inspection scope and updatesWhat was inspected, what could not be inspected, and has the server or a dependency changed since the last review?
Public evidence
Inspection evidence published by MCP Guard
Explore cumulative collection and inspection activity, alongside MCPs currently published in the Registry.
MCPs reviewed
Cumulative inspections
Restricted or blocked
Inspection items
Decision and operation
How to act on review results
A single score should not declare a server safe. Match the intended use to the available evidence and choose an appropriate access boundary.
How to read inspection results
PASS, WARN, RESTRICT, and BLOCK are ordered by how strictly use must be controlled. NEED_REVIEW is separate: the available evidence was insufficient to determine safety.
The inspection found items that require caution.
The inspection found high-risk behavior, permissions, or vulnerabilities. Use only after every required technical control is enforced and verified.
The inspection met high-impact prohibition criteria. Do not use this server.
Separate from the risk scale
NEED_REVIEWUnable to determine
The available evidence was insufficient, so safety could not be determined.
Continuous review after adoptionFor every inspection result, review tool lists, permissions, external connections, and behavior again after server or dependency updates.
Frequently asked questions
MCP security fundamentals
What is an MCP vulnerability?
An MCP vulnerability is a flaw or weakness in an MCP server, client, or dependency that could lead to unauthorized actions or data exposure if exploited. Publisher provenance, permissions, credentials, and outbound data transfer are important adoption risks, but not all of them are vulnerabilities.
What is MCP security?
MCP security is the practice of reviewing and controlling server provenance, runtime, permissions, credentials, external connections, and post-update behavior when an AI system connects to tools or data through the Model Context Protocol.
Is a popular MCP server automatically safe?
No. Popularity does not verify the publisher, implementation, permission scope, outbound data flow, or future updates. Each server still needs an adoption review.
Do HTTPS and OAuth make an MCP server safe?
They protect parts of transport and authentication, but they do not prevent excessive tool permissions, malicious tool descriptions, compromised dependencies, unexpected data transfer, or behavior changes after an update.
Does a PASS result guarantee that a server is safe?
No. It means no issue was found within the evidence and inspection scope available at that time. Reinspection is needed when the server or its dependencies change.
What is the difference between Free and Pro access?
Signed-in Free users can search simplified information for every MCP server. Pro adds inspection evidence, CSV and JSON exports, and update-drift review.
References
Public security guidance
Use MCP Guard inspection evidence alongside public security guidance from the MCP project, OWASP, and the NSA.
Related guides
Checks by environment and risk
Continue with focused checks for stdio, runtime monitoring, Claude, Cursor, Codex, and other adoption contexts.
MCP vulnerabilities and known casesIntended permissions, affected releases, and adoption checksProduct and technical documentationMCP basics, inspection technology, statuses, and Free / Pro coverageMCP security product comparisonDocumented use cases, review scope, and adoption conditionsMCP STDIO/RCELocal process, stdio, and command execution reviewMCP runtime guardPost-update drift, dangerous operations, and required controlsMCP server checklistSource, permissions, destinations, and data-transfer scopeMCP server riskPermissions, inputs, operations, and prompt-injection exposureSafe MCP listFields for managing approved MCP candidates in a teamClaude Code MCP securityPre-adoption review fields for Claude CodeClaude MCP setup reviewConfiguration review for Claude Desktop and Claude CodeCursor MCP securityPre-adoption review fields for CursorCodex MCP securityBoundary review for CLI agents using MCPResearch BlogPublic Registry observations for MCP adoption review
Technical documentation
MCP Server DB
Research Blog