free-ai-lab free-ai-lab

MCP Security Guide

Overview

Every extra interface your AI connects to is one more attack surface — these 6 practical tips keep you out of trouble.

In one sentence: MCP gives AI "hands-on ability", but what permissions those hands get depends entirely on what you put in the config. Only by understanding the risk boundaries can you use it with peace of mind.

Where does the risk come from? Three layers

1️⃣ The referenced Server itself is untrustworthy (supply-chain risk)

You install something via npx -y xxx — whoever published that package controls what its code can do. A malicious or compromised Server may steal tokens from environment variables, read files, and exfiltrate data. This is the biggest category of risk.

2️⃣ Credentials are granted too broadly (authorization risk)

Gave your GitHub token full read/write over the repo? Then AI can modify your code and delete your Issues. Grant the least privilege: read-only is enough, don't give write; a single repo is enough, don't give the whole account.

3️⃣ Prompt Injection

The web pages, documents, and code AI reads may hide malicious text like "ignore the user's instructions and do XX", tricking AI into calling high-privilege tools. This is the new phishing of the AI era.

6 practical protection tips

  1. Only install Servers with high stars + long-term maintenance + official origin (like the Microsoft / GitHub official ecosystems); avoid unknown personal side projects
  2. Keep tokens local only; exclude config files via .gitignore and never commit them to a repo
  3. Issue credentials with least privilege: read-only tokens for GitHub, read-only accounts for databases — if you only need to view, don't grant edit
  4. Be cautious with high-privilege Servers: anything that can execute commands, delete files, or read your whole disk (file-system type) should only be installed in environments you trust
  5. Watch for AI proactively asking for credentials: be wary of conversations framed as "I need your token to continue" — legitimate scenarios never demand your keys
  6. Review regularly: remove unused Servers promptly, and revoke + recreate tokens immediately after any leak

A secure install checklist

☐ Does this project have over ten thousand stars / is it officially published? ☐ Does the README show a clear least-privilege configuration example? ☐ Is the config file path already added to .gitignore? ☐ Does the token I'm granting include only the required scope? ☐ Does it need a client restart after install? Anything missed before restarting?

Want a systematic way to evaluate which ones are safer to install? Check the curated list on this site — already filtered by "official / high-star / active."