The full answer
Judge it by what it runs, what it can reach and what it feeds the model. A local MCP server runs with your privileges, so its install command is code you are executing. Read that command, check who publishes the package, see which credentials and scopes it wants, and ask whether its output could carry instructions from outsiders. Then run it with the least access it needs, sandboxed where possible.
1. The 4 questions
| Question | Red flag |
|---|---|
| What exactly does it execute? | A truncated or piped install command (npx x && curl ...), an unpinned version, a package with no source |
| Who publishes it? | A new account, a name one letter off a known package, no repository |
| What can it reach? | Broad tokens ("all repos", "admin"), your whole home folder, a shell |
| What does it return to the model? | Web pages, emails, tickets or issues written by people outside the team |
The last row is Prompt Injection: text inside a fetched page can tell the agent to do things, and the agent may follow it with the server's permissions.
2. Run it narrowly
- Pin the exact version; review changes before upgrading.
- Give it a token scoped to one project or read-only, never your personal admin token. Servers must not pass your token through to other services.
- Prefer the local stdio transport for local servers, inside a container or sandbox with no access to
~/.sshor cloud credentials. - In Claude Code, project servers in
.mcp.jsonneed approval, and an organisation can block servers withdeniedMcpServersin managed settings.
3. Keep watching
- Log the tool calls the agent makes through it.
- Watch output size: Claude Code warns above 10,000 tokens of tool output, a sign a server returns far more than the task needs.
- Remove servers nobody has used in a month.
4. A quick decision
Read-only, pinned, well-known publisher, internal data only: allow. Writes or secrets plus outside content: allow only with a sandbox, a narrow token and human approval for writes. Unknown publisher and a shell: no. See Model Context Protocol.
What interviewers want: the install command as code execution, publisher and pinning checks, least-privilege tokens with no token passthrough, prompt injection through returned content, sandboxing and client-side controls, and ongoing logging.
Last updated 22 October 2026
Sources