Is mcp safe?

The component writes to a config file of a separate AI client (Claude Desktop, Cursor, VS Code, Continue, Windsurf), or, in the user's home directory, to an AI agent's settings, skills, subagents, commands or instruction and memory files (Claude Code, Codex, Gemini CLI, Cursor rules, AGENTS.md, CLAUDE.md). A server, hook or instruction added there loads in the agent's next session. That is expected from a command the user runs to set the agent up, and unexpected from code that runs on install or import.

config_file = config_dir / "claude_desktop_config.json"

Fix: Confirm why the component edits an agent's configuration or instructions. A tool that registers itself should ask the user and write only what it says it writes.

The component can run operating-system commands or spawn processes.

subprocess.run([cmd, "--version"], check=True, capture_output=True, shell=True)

process = subprocess.run(
            [npx_cmd, "@modelcontextprotocol/inspector"] + uv_cmd,
            check=True,
            shell=shell,
            env=dict(os.environ.items()),  # Copy the environment for subprocess launch
        )

popen_obj = subprocess.Popen(
        [command, *args],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
        stderr=errlog,
        env=env,
        cwd=cwd,
        bufsize=0,  # Unbuffered output
        creationflags=ge …

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.

The component reads files from disk.

config = json.loads(config_file.read_bytes())

with open(self.path, "rb") as f:

with open(self.path, "rb") as f:

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

config_file.write_text("{}", encoding="utf-8")

config_file.write_text(json.dumps(config, indent=2), encoding="utf-8")

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (10 occurrence(s) shown as evidence).

if self.context.oauth_metadata and self.context.oauth_metadata.authorization_endpoint:

auth_endpoint = str(self.context.oauth_metadata.authorization_endpoint)

"grant_type": "authorization_code",

"grant_type": "refresh_token",

oidc_path = f"/.well-known/openid-configuration{parsed.path.rstrip('/')}"

oidc_path = f"{parsed.path.rstrip('/')}/.well-known/openid-configuration"

urls.append(urljoin(base_url, "/.well-known/openid-configuration"))

authorization_endpoint=authorization_url,

authorization_endpoint: AnyHttpUrl

url="https://example.com/oauth/authorize",

Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.

An MCP tool surface (manifest or tool definitions) was found.

self._lowlevel_server.add_request_handler(
                "tools/call",

async with stdio_server() as (read_stream, write_stream):

self.add_tool(tool.fn, meta=tool.meta, **tool.kwargs)

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.