Vibe Coding and MCP Security: What Every AI Developer Needs to Know

Published April 8, 2026 · 8 min read · By Andreas Tissen

Vibe coding — letting an AI write most of your code while you guide it at a high level — has gone from a meme to a mainstream workflow. Claude Code, Cursor, Windsurf, and a dozen other tools have made it practical to build real software without writing every line yourself.

MCP servers are the power-up that makes vibe coding even faster. Want your AI to read your database? Add an MCP server. Access GitHub? Add an MCP server. Browse the web, run terminal commands, manage files? MCP server, MCP server, MCP server.

The problem: every MCP server you add runs with your full permissions, in your local environment, with direct write access to your AI's context. Most developers add them without a second thought. I scanned 50 popular MCP servers and found that the average security posture is mediocre at best.

This is the security guide I wish existed when I started vibe coding with MCP.

What Makes MCP Different From Regular Dependencies

When you npm install some-package, you're adding code that runs when your app runs. You can audit it, pin the version, and at least in theory contain the blast radius.

MCP servers are different in a few important ways:

• They run as a persistent local process — not just when your app runs, but whenever your AI tool is open.
• They have direct write access to your LLM's context window — every tool response they send becomes part of what your AI "sees".
• They run with your OS-level permissions — the same permissions you have as a logged-in user. No sandboxing.
• Most are installed via simple config edits, not through a package manager with any security infrastructure.

That last point matters. When you add an MCP server to your Claude Desktop or Claude Code config, there's no lockfile, no signature verification, no automatic update mechanism. You're just pointing at a GitHub repo and trusting it.

The Attack Vectors That Actually Worry Me

1. Tool Poisoning

This is the most subtle and dangerous attack. MCP servers define tools with descriptions that your AI reads to understand what the tool does. A malicious server can embed hidden instructions in those descriptions:

Your AI can't distinguish between legitimate tool descriptions and injected instructions. It reads both as authoritative context. This is called tool poisoning or prompt injection via MCP.

2. Supply Chain Compromise

You found a popular MCP server on GitHub. 500 stars, looks legit. You add it to your config.

Three months later, the maintainer's npm account gets phished. A new version is published with a hidden data exfiltration payload. You run npm update and you're now running malware.

This isn't hypothetical. The npm ecosystem has had dozens of high-profile supply chain attacks. MCP servers published as npm packages are subject to the same risks.

3. Overly Permissive Scopes

Many MCP servers request permissions they don't need. A server for reading documentation might also request write access to your filesystem. A GitHub integration might request admin-level OAuth scopes when read-only would suffice.

When I scanned 50 MCP servers with audit.pyfio.com, I found that 23 of them declared filesystem or shell execution capabilities beyond what their stated purpose required.

4. Abandoned Maintenance

The MCP ecosystem is moving fast. A server that was well-maintained six months ago might be abandoned today. Unpatched dependencies pile up. Security vulnerabilities get disclosed but never fixed. The README still says "actively maintained."

Abandoned servers are a quiet risk — they don't announce themselves as dangerous.

The Vibe Coding Multiplier Effect

Vibe coding amplifies both the productivity gains and the security risks from MCP servers. Here's why:

You're delegating judgment. When you vibe code, you're trusting your AI to make implementation decisions. If your AI has been fed malicious instructions through a poisoned MCP tool, it will execute them faithfully and competently. The better your AI, the better it will follow bad instructions.

You're moving fast. The whole point of vibe coding is speed. Speed and careful security review are in tension. Most vibe coders add MCP servers quickly, without spending time auditing what they're installing.

Your AI has broad access. Effective vibe coding usually means giving your AI access to your codebase, terminal, and often your development databases. That's a big blast radius if something goes wrong.

What Good MCP Security Hygiene Looks Like

Before Installing Any MCP Server

1. Audit it. Use audit.pyfio.com to get a security report in ~60 seconds. It checks tool descriptions for injected instructions, analyzes permissions, reviews dependencies for known vulnerabilities, and assesses maintenance signals.
2. Read the source code. At minimum, scan the file that defines the tools. Look at what each tool description says. Check what filesystem paths it accesses.
3. Check when it was last updated. If the last commit is more than 6 months ago and the dependency tree is large, be cautious.
4. Pin the version. If you install from npm, pin to a specific version. Don't let it auto-update silently.

After Installing

1. Review what permissions it actually uses. Watch the first few sessions. Does the server behave as advertised?
2. Re-audit periodically. Supply chain compromises can happen after you first install. Audit again when you see new releases.
3. Remove servers you don't use. Inactive MCP servers are attack surface that serves no purpose. Clean up your config.

For Teams

1. Maintain a shared allowlist of approved MCP servers. Don't let individual developers add arbitrary servers to shared development environments.
2. Document what each server does and why it's needed. This forces the justification conversation and creates an audit trail.
3. Include MCP servers in your security review process like any other third-party dependency.

The Risk Profile by Server Type

What I Found When I Scanned 50 MCP Servers

I ran all 50 of the most-starred MCP servers on GitHub through audit.pyfio.com. The results were sobering:

• 43 of 50 had no analyzable JavaScript or TypeScript source code — they're compiled, minified, or use dynamic requires that make static analysis harder.
• 1 critical finding: a server using eval() on user-controlled input.
• Average security score: 90.5/100 — but that average hides significant variance. The bottom quartile had scores in the 60s.
• 12 servers had unmaintained dependencies with known CVEs.
• 8 servers requested filesystem or shell permissions without documenting why.

The full methodology and findings are in I Scanned 50 Popular MCP Servers. Here's What I Found.

Practical Checklist: Before You Add That MCP Server

• Run it through audit.pyfio.com — takes 60 seconds
• Read the tool definitions (look for hidden instructions in descriptions)
• Check the last commit date and open issues
• Verify the permissions match what the server claims to do
• Pin to a specific version if installing from npm
• Consider whether you actually need this server or if a simpler approach works

If you want the full 15-point checklist with remediation guidance, see MCP Security Checklist: 15 Things to Check Before Deploying.

Bottom Line

Vibe coding is powerful. MCP servers make it more powerful. Neither of these things is inherently dangerous — but both reward moving fast, and moving fast without security review is how you get compromised.

The fix is not complicated. Before you add an MCP server, spend two minutes on it. Read the tool descriptions. Check when it was last updated. Run an audit. The ecosystem is young enough that security hygiene is still the exception. Being in the minority that actually checks is meaningful protection.