MCP Server Security Checklist for Developers

Before adding any entry to your MCP config, check: Who published it? Does the package on npm or PyPI link to a real, maintained GitHub repository? Does the repository have a meaningful commit history, not just a one-file skeleton pushed yesterday?

A package name that mimics a popular tool (typosquatting) is a known attack vector across the Node and Python ecosystems. Verify the exact package name matches what official documentation references.

Config files end up in backups, dotfile repositories, and cloud sync folders. A plaintext API key in a config file that gets pushed to GitHub — even briefly — is effectively compromised.

Instead, use the env block in your config to pass environment variables to the server process. Set those variables in your shell profile or a secrets manager, not in the config file itself.

// Bad: secret inline in config
{
  "mcpServers": {
    "my-api-server": {
      "command": "npx",
      "args": ["-y", "my-api-server"],
      "env": {
        "API_KEY": "sk-live-abc123HARDCODED"  // ❌ never do this
      }
    }
  }
}

// Keep secrets out of version control -- gitignore this file
{
  "mcpServers": {
    "my-api-server": {
      "command": "npx",
      "args": ["-y", "my-api-server@1.2.3"],
      "env": {
        "API_KEY": "sk-your-real-key"  // literal value; never commit it
      }
    }
  }
}

Note: whether your MCP host expands ${VAR} syntax depends on the host implementation. Confirm how your specific host handles env var injection before relying on it.

Most filesystem MCP servers accept a root directory argument that restricts which paths the server can access. Pass the specific project directory you are working in rather than your home directory or the drive root.

// Narrow scope — only the current project
"args": ["C:\\Users\\you\\projects\\my-project"]

// Too broad — exposes everything
"args": ["C:\\Users\\you"]  // ❌ includes SSH keys, browser profiles, etc.

Directories to avoid passing as a filesystem server root include:

• ~/.ssh — SSH private keys
• ~/.aws, ~/.azure, ~/.config/gcloud — cloud credentials
• Browser profile directories — stored passwords and session cookies
• Password manager data directories
• Any directory that contains .env files with secrets

If your project directory happens to contain a .env file, make sure the MCP server you are using does not read or transmit it.

A shell execution server can run any command the model sends it. This means that a single bad model output — whether from a mistake, a jailbreak, or a prompt-injection attack — can delete files, exfiltrate data, or install software.

If you use a shell server, consider restricting it to a specific allow-list of commands if the server supports that, running it inside a container or virtual machine, and never leaving it enabled in your config when you are not actively using it.

When building a system that uses MCP servers fetching external data (web pages, third-party API responses, user-submitted documents), design your prompting and system instructions to remind the model that tool results are data to be processed, not instructions to be followed. The effectiveness of this varies by model and context, but it is a meaningful mitigation.