Vet MCP servers before you connect them
Connecting an MCP server runs someone else's code and feeds its tool descriptions to your model. Treat it like adding a dependency with shell access — because that is what it is.
What you are actually connecting
An MCP server is not a passive data source. Connecting one runs its code on your machine and feeds its tool descriptions straight into your model's context. So it is two attack surfaces at once: ordinary software supply-chain risk, plus a prompt-injection channel most clients do not even show you. Treat adding one like adding a dependency that also has shell access — because that is what it is.
This is not hypothetical
In July 2025, CVE-2025-6514 landed against mcp-remote, a popular MCP proxy: a 9.6-critical OS command injection triggered by connecting to a malicious server. Not by using a tool — by connecting. That is the whole threat model in one CVE. Command-injection bugs in individual servers, where unsanitised tool arguments get shelled out, are the dominant real-world class.
The injection class
The softer attacks share one root cause: untrusted text in tool metadata enters the model's context. Tool poisoning hides instructions in a tool's description. Line jumping influences the model at connect time, before you invoke anything. A rug pull gets a benign tool approved, then swaps its behaviour later. Different names, same weakness.
A directory listing is not an audit
Worth saying plainly, because it is a common misread: Anthropic's own docs note that connectors are reviewed against listing criteria for the directory but not security-audited. "It is in the official list" means it met listing criteria, not that someone checked it for the bug above. The trust decision is still yours.
How to vet one
Nothing exotic — dependency hygiene with the stakes turned up:
- Prefer servers you wrote, or ones from a publisher you would already trust with a dependency.
- Read the source, or at least the tool definitions, before connecting.
- Pin an exact version and disable auto-update on anything that matters — that is your defence against the rug pull and the unreviewed patch.
- Run it least-privilege: minimal scopes, minimal credentials, a sandbox or container for anything untrusted. Bind local servers to
127.0.0.1, never0.0.0.0. - Keep a human in the loop on tool calls. The injection attacks are dangerous precisely because they bypass that approval.