How to Audit an MCP Server Before Installing It (A Practical Checklist)

How to Audit an MCP Server Before Installing It (A Practical Checklist) You wouldn't npm install a random package without glancing at it first. MCP servers deserve the same scrutiny — they run with broader permissions than most npm packages. Here's a practical audit you can run in under 10 minutes. Step 1: Check the Source Before running anything: # Clone the repo instead of installing directly git clone https://github.com/author/mcp-server cd mcp-server # Check recent commit history — is it actively maintained? git log --oneline -10 # Check who has push access — is it a single developer or an org? # Look at GitHub → Settings → Collaborators (if you have access) Red flags: Last commit was 6+ months ago Single anonymous developer No license file No README explaining what the server does Step 2: Scan for Shell Execution MCP servers that execute shell commands are the highest-risk category. # Search for shell execution patterns grep -r "exec\|spawn\|execFile\|execSync\|spawnSync\|child_pr