How to Vet MCP Servers Before Installation
SelectionBitter6821 · reddit · 2026-07-15
The post asks if teams perform security reviews before pulling MCP servers and agent skills from GitHub.
Concerns include:
- Lack of npm lockfile/audit-like mechanism to detect risks like 'tool descriptions inducing model to exfiltrate data'
- Static scanning only covers part of the problem, and remote behavior may change after installation
- Wants to know industry practices: whitelisting, manual review, network egress controls, or accepting risks.
Core discussion: security governance of MCP/agent tools, especially tool supply chain and runtime control.
Related event: Developers Discuss Security Audits for MCP Servers(2 posts)→
More from coding & agent
- He benchmarks new models by having them build their own copilot — $28 of compute — bucolucas · 2026-10-27
- Should agents be allowed to change plans mid-task? Reddit debates the drift boundary — wistfulcracker84 · 2026-10-27
- HeyGen + Canva MCP turns slide speaker notes into an avatar presentation video — HeyGen · 2026-10-27
- Local beats cloud: Qwen 3.8 FN handles private student data as well as frontier models — dr_lm · 2026-10-27
- LLM Tails cuts agent input tokens 80% by making agents read before they write — savadks1818 · 2026-10-27
- 10 practical ways to run Astra computer use on Premiere Pro for video editing — beechinour · 2026-10-27