Provenance and supply chain
- Verify the publisher. Follow links from the official product or organization, not a copied snippet.
- Review the source. Check installation scripts, dependencies, network destinations, and release history.
- Pin an exact version. Avoid floating tags and implicit latest releases.
- Record what you approved. Keep the package, version, checksum or commit, and intended purpose.
Configuration and launch
- Scan for secrets. Rotate any credential placed in a file or shared message.
- Avoid shell indirection. Prefer an executable with fixed arguments.
- Remove auto-install flags. Do not silently approve new package downloads.
- Use least privilege. Run as a normal user and avoid administrator elevation.
- Narrow filesystem scope. Grant specific directories, never a drive, root, or entire home folder without a demonstrated need.
Remote transport and identity
- Require encrypted transport. Use HTTPS except for deliberate loopback development.
- Keep tokens out of URLs. URLs leak through logs, analytics, history, and referrers.
- Minimize credential scope. Prefer short-lived tokens tied to the user and intended server.
Runtime and operations
- Inspect every exposed tool. Names and descriptions can change after installation.
- Plan for hostile content. Retrieved pages and documents can contain prompt injection; require confirmation for consequential actions.
- Monitor change. Re-review package updates, tool-list drift, new scopes, unusual traffic, and unexpected file access.
Do not collapse trust decisions into one score. A scanner can prioritize review, but publisher identity, runtime behavior, and your own data sensitivity require human judgment.
Start with the configuration layer
Run the free local checker, remediate findings, then complete the runtime items above.
Scan an MCP config →