Directory / MCP servers (protocol)
MCP servers (protocol)
The spec says hosts should get user consent before tool calls and treat tool descriptions as untrusted. HTTP servers use OAuth 2.1 with audience-bound tokens. Real safety depends on each host and server.
Lock this down first
Only install servers you trust, and never pass a server's token through to upstream APIs.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | 2/3 | |
| Human approval gates | 2/3 | Consent is a SHOULD in the spec. Hosts decide how it works. |
| Sandboxing | Unverified | Not confirmed in the docs we checked. |
| Secrets handling | 3/3 | OAuth 2.1 with PKCE and resource indicators. Token passthrough is forbidden. |
| Audit logs | Unverified | Not confirmed in the docs we checked. |
| Kill switch / interrupt | Unverified | Not confirmed in the docs we checked. |
| Network egress control | Unverified | Not confirmed in the docs we checked. |