How to vet an MCP server: a 10-minute checklist
Before you add an MCP server to Claude Code, Cursor or another client, check four things: who maintains it, exactly what it can touch (shell, files, network, accounts or money), where its secrets will live, and whether the code or remote endpoint can change after you approve it. Then scan your own config with a tool such as mcp-audit, and only keep servers whose install snippet comes from the maintainer’s official README.
The checklist
1. Source and maintainer
Prefer the vendor’s official repository or a well-known maintainer. A fork with a similar name is a warning sign. On Stack Registry every listing links its upstream repo, license, star count and last push, refreshed from GitHub. Start in the directory or the dev-tools category.
2. Install snippet provenance
Copy the config from the official README, not from a blog or a social post. Our listings copy snippets verbatim and show the date and method of the check. We only say “tested” when we actually ran the tool. See How we verify.
3. Auth and secrets
Each listing shows an auth line (none / API key / OAuth). Read what that key or scope can do. Tokens placed in env blocks of client configs are readable on disk. mcp-audit’s scan command (APIsec, MIT) looks for exposed API keys, tokens and database passwords in Claude Desktop, Cursor, VS Code, Windsurf and Zed configs, and also reports connected endpoints and risk flags. A no-install web app is offered on the project site.
4. Capabilities
Note whether the server gets shell access, filesystem access, a signed-in browser profile, network access, or the ability to move money. Those are the highest-risk permissions. Start read-only when the README offers it. For example, Alpaca MCP Server can place real trades, so start with a paper trading account. mcp-audit flags shell access, filesystem access and unverified sources as risk flags. Tools that attach to your own Chrome profile can see signed-in sites — see the browser category.
5. Source code, for in-house or unknown servers
mcp-audit source-scan <path> reads the server’s own source and flags the “prompt in, shell out” pattern: an LLM-controlled tool argument passed unsanitised into child_process.exec, subprocess.run(shell=True), os.system and similar. --exit-code lets you block merges on critical findings in CI. The scanner only opens files that look like MCP server source. A clean scan is not a guarantee of zero risk: the project’s README is explicit that it provides visibility, not certainty.
6. Remote servers can change
A remote (URL-based) server can change its tools behind the same address after you connect. Prefer maintainers who publish versions or changelogs, and re-check periodically.
7. Agent skills too
Skills bundled with or alongside a server are instructions your agent will follow. Read the SKILL.md and any scripts it runs. NVIDIA SkillSpector (Apache-2.0) scans Claude Code, Codex and MCP skills for prompt injection, data exfiltration, supply-chain risks and related patterns before you install them; it also ships an MCP extra so you can run it from a client. Browse other packs in the skills category.
8. Maintenance
Look at the last push and at open security issues. Archived or stale repositories are a signal. We mark archived upstreams on the listing — for example, the self-hosted Browserbase MCP server.
Questions
Is it safe to install MCP servers from GitHub?
It depends on the server. Read what it can access, prefer official or widely used maintainers, copy the install snippet from the official README and scan your setup for exposed secrets.
How do I check my MCP config for leaked API keys?
Run mcp-audit scan (APIsec, MIT). It inventories the MCP servers configured in Claude Desktop, Cursor, VS Code, Windsurf and Zed and reports secrets, endpoints and risk flags. A no-install web app is also offered.
What is the riskiest MCP permission?
Shell execution, followed by broad filesystem access, access to a signed-in browser, and anything that can move money. Those let a manipulated prompt reach your machine, accounts or funds.
How do I check an agent skill before installing it?
Read its SKILL.md and any scripts it runs, then scan it with a tool such as NVIDIA SkillSpector, which looks for prompt injection, data exfiltration, supply-chain risks and related patterns.
Does Stack Registry test every server?
No. We verify that install snippets match the official README and show the check date and method on each listing; we label something “tested” only when we ran it.
This is the long-form version of the “check before you install” theme in Stack Registry #3.
One email. The agent tools worth installing this week.
New and updated MCP servers, one starter stack, and what broke. Unsubscribe in one click.