MCP Security FAQ

What is MCP?

MCP stands for Model Context Protocol. It is a standard protocol for connecting AI agents to external tools and data sources. An MCP server exposes typed tools (like "read a file" or "search a database") that an AI agent can discover and call. Anthropic introduced MCP, and it has since been adopted by OpenAI and the broader AI community.

Why does MCP security matter?

When you add an MCP server to your agent's configuration, you are giving it access to your system. Depending on the server, that could mean your filesystem, your network, your API keys, or the ability to execute shell commands. A server with a vulnerability or malicious code can read your files, exfiltrate data, or run arbitrary commands on your machine.

Does MCP enforce permission boundaries?

No. The MCP protocol defines how agents communicate with servers, but it does not enforce what servers can actually do. A server declares its capabilities through tool definitions, but nothing prevents it from doing more than it declares. There is no built-in sandbox or capability system. For more details, see MCP Permissions Explained.

How do I audit an MCP server?

Two ways. Manually: review the source code for dangerous patterns (eval, exec, unsanitized inputs), check the dependencies, verify the license, and review what permissions the server requests. Automatically: use audit.pyfio.com to scan any public GitHub repo. The scanner checks permissions, code safety, supply chain risk, transparency, and maintenance. See the Getting Started tutorial for a step-by-step walkthrough.

What does the audit score mean?

The score ranges from 0 to 100 and is a weighted average of five categories: Permissions and Scope (30%), Code Safety (25%), Supply Chain (20%), Transparency (15%), and Maintenance (10%). A score of 90+ is low risk. 70-89 is moderate risk. Below 70 indicates significant issues. The score is a starting point, not a final verdict. Always review the specific findings.

Is the audit free?

Yes, for public GitHub repositories. Go to audit.pyfio.com, paste the repo URL, and get a full report in about 60 seconds. No account required.

What languages does the scanner support?

Code safety analysis currently covers JavaScript and TypeScript. Permissions, supply chain, transparency, and maintenance checks work for any language. 43 of the 50 most-starred MCP servers are written in Go, Rust, or Python, so their code safety scores are incomplete. I am expanding language support.

Can I audit private repositories?

Not yet through the web interface. If you need private repo auditing or enterprise-scale scanning, email hello@pyfio.com.

What can a malicious MCP server actually do?

Depending on its permissions: read your files (source code, credentials, SSH keys), write or modify files, make network requests (exfiltrate data to external servers), read environment variables (API keys, tokens), and execute shell commands. The worst case is full access to everything your user account can access.

Are popular MCP servers safe?

Mostly, but not guaranteed. In a scan of the 50 most-starred MCP servers, the average score was 90.5 out of 100. But Google's gemini-cli scored in the bottom five, and a server with 7,000+ stars had an eval() call in a Chrome extension. Popularity correlates with quality but does not guarantee security. See the full scan results.

What is the most common security issue?

The most common finding is "no source files found for analysis," which means the scanner cannot fully evaluate the code. Among actual security issues, the most common are: missing lockfiles (5 of 50), missing security documentation (11 of 50), and broad permission requests (filesystem plus network access).

How is MCP different from giving an agent shell access?

MCP provides a structured interface with typed tools and auditable interactions. Shell access gives the agent unrestricted command execution. MCP is narrower and more auditable, but the server itself might be insecure. See MCP vs CLI for a detailed comparison.

Does the EU AI Act apply to MCP servers?

The EU AI Act does not mention MCP by name, but it applies to AI systems broadly. If you deploy AI agents with MCP servers in the EU, the Act's requirements for risk assessment, documentation, and human oversight apply to your entire system, including the MCP servers. The general-purpose AI provisions take effect August 2, 2026. See The EU AI Act and MCP for details.

Do I need to audit third-party MCP servers for compliance?

If your AI system is classified as high-risk under the EU AI Act, yes. You are responsible for the security and compliance of all components, including third-party servers. You cannot outsource compliance by using someone else's MCP server.

What should I do right now?

1. List every MCP server in your agent configs
2. Scan each one at audit.pyfio.com
3. Review any high or critical findings
4. Remove or replace servers with unacceptable risks
5. Make auditing part of your workflow for new servers

For a printable checklist, see the MCP Security Checklist.