What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
MCP servers should be treated as privileged integrations, not harmless plug-ins. A server can expose tools, data and prompts to an AI host, while the model dynamically chooses calls and supplies natural-language arguments. That makes the trust boundary include the host, client, server, transport, tool code, credentials and returned content. Secure deployments authenticate every request, grant the smallest useful scope, validate inputs server-side, pin tool definitions and dependencies, isolate execution, and record enough telemetry to investigate abuse.
This guide explains what can go wrong with local and remote MCP servers, how to assess a deployment, and how to build practical controls around identity, tools, state, supply chain and operations.
Why MCP creates a different security boundary
The Model Context Protocol lets an AI host discover servers that provide tools, resources and prompts. Unlike a conventional API client that follows fixed application code, an agent may select a tool after reading its description and may construct arguments from untrusted web pages, documents or messages. The model is therefore part of the request path, but it is not a security control.
OWASP describes the resulting attack surface as a combination of prompt injection, supply-chain compromise, confused-deputy behavior and delegated access. A useful review follows the whole chain:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- Host and client: where servers are configured and where approvals are displayed.
- Transport: local stdio, remote HTTP or another channel, including TLS and origin handling.
- Server and tool implementation: code that interprets arguments and reaches files, networks or other APIs.
- Identity and credentials: user tokens, service accounts, OAuth grants, API keys and secrets in logs.
- Model-visible content: tool descriptions, schemas, prompts and returned results.
Ask what a malicious server, a compromised dependency, an injected document and a curious user could each cause independently. The answer should not depend on the model behaving perfectly.
The main MCP server risks
Tool poisoning and “rug pulls”
Instructions can be hidden in a tool description, JSON schema or result. A server that was safe when approved can later change its definitions or behavior. The model may follow the new text because it appears to be part of the tool contract. Pin an approved manifest, record hashes or signed versions where available, review changes, and require re-approval when a definition changes.
Prompt and context injection
Untrusted content can tell an agent to call an unrelated tool, disclose data or use dangerous parameters. Treat text from webpages, tickets, files and tool results as data, not instructions. Keep policy decisions outside the model and separate trusted instructions from retrieved content before it is presented to the model.
Confused deputy and privilege creep
A server may hold more authority than the user intended. An agent then becomes a deputy that can combine that authority with an innocuous request. Broad OAuth grants are especially dangerous when several systems share one connection. Use per-workflow scopes, read-only permissions by default, short expiries and explicit approval for writes, payments, code execution and destructive operations.
Token and secret exposure
Long-lived or hard-coded credentials can leak through configuration, logs, model context, crash dumps or a prompt-injected response. Use a secret manager, short-lived narrowly scoped credentials and automated secret scanning. Redact secrets before logging arguments or results, and never place a credential in text that the model can retrieve.
Weak authentication and authorization
Authorization based on client-supplied context, missing audience checks or token passthrough can let one service use a token minted for another. The MCP authorization guidance requires a server to accept only tokens intended for itself and to reject tokens whose audience does not identify that server. Validate issuer, audience, expiry, scopes and the authenticated subject on every call. When calling an upstream API, exchange for a separate upstream token rather than forwarding the client token.
Command injection and unsafe local execution
A local stdio server may be able to read files, start processes or reach internal networks. Unsanitized paths, URLs and shell arguments can turn a normal tool call into code execution. Do not concatenate user-controlled strings into shell commands. Prefer direct library calls, strict schemas, allow-lists and a sandbox with a dedicated low-privilege account.
Supply-chain compromise and shadow servers
An unreviewed package, dependency update or server added to a client configuration can defeat otherwise sound policy. Maintain an allow-list of approved servers, pin versions and dependencies, verify provenance or signatures where available, scan for vulnerabilities and secrets, and review the exact command and environment used to launch each local server.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSession and state-handle attacks
A state handle is not proof of identity. The MCP security guidance explicitly says servers must not treat possession of a state handle as authentication. Generate unpredictable, expiring handles, bind them to the authenticated user and intended client, reject reuse, and protect them in transit. Store only the minimum state needed to complete a flow.
Missing telemetry and replay protection
Without a correlation trail, an operator cannot tell which principal invoked a tool, with what arguments or whether a message was replayed. Use unique request identifiers, expiration and replay checks, and logs that preserve security evidence without exposing secrets.
How to secure an MCP server
1. Establish identity before tools are available
- Use an OAuth 2.1-aligned flow for remote servers and TLS for the transport.
- Require the client to send the
resourceparameter and validate issuer, audience, expiry, scopes and subject. - Reject tokens issued for another service; never use a client token as an upstream credential.
- Bind sessions and state handles to the authenticated user and client, and expire them quickly.
For local stdio, authenticate the launching user through the operating system and process boundary, then still apply authorization inside the server. Local does not mean trusted: a malicious package or another process on the host may be the attacker.
2. Define least privilege as a policy, not a prompt
- Expose only the tools and resources required for one workflow.
- Separate read and write tools and use read-only scopes as the default.
- Require a human step-up approval for payments, deletion, code execution, account changes and external publication.
- Use separate service identities for development, staging and production.
- Review OAuth scopes and connected accounts on a schedule, not only at installation.
3. Freeze and review the tool contract
Keep an approved manifest containing tool names, descriptions, schemas, required scopes and expected destinations. Detect additions, removals and edits. A changed description is a security event even when the executable version is unchanged. Review provenance and have a second person approve high-impact changes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
4. Validate every request on the server
Enforce policy after the JSON-RPC message arrives and before any side effect. Validate:
- Message structure, method names, schema types and required fields.
- Numeric bounds, string lengths, output sizes and pagination limits.
- URLs against an allow-list of schemes, hosts, ports and redirect behavior.
- File paths after canonicalization, preventing traversal and symlink escapes.
- Shell arguments without interpolation; reject metacharacters if a shell is unavoidable.
- Destination, tenant and record ownership using server-side identity, not model-supplied fields.
Return a safe error and stop on failure. Do not rely on the model to notice that an argument is unsafe.
5. Isolate execution and data
Run a local server as a dedicated unprivileged user in a sandbox or container. Use read-only mounts, a minimal filesystem view, egress allow-lists and a restricted network namespace. Deny access to credential files, cloud metadata endpoints, host sockets and unrelated project directories. Keep secrets out of model-visible context and redact them from logs.
6. Protect transport, browser clients and state
Use TLS for remote connections, verify certificates, enforce origin checks and configure an appropriate content-security policy for web clients. Add replay protection with one-time nonces or expiring request identifiers. Do not treat a bearer state handle as an authenticated session.
Recommended Free Tools
7. Control the software supply chain
Pin server and dependency versions, generate a lockfile, verify package provenance and signatures where available, and scan continuously for vulnerabilities and secrets. Keep an inventory of the exact servers enabled in each client configuration. Remove abandoned or duplicate servers rather than leaving them dormant.
8. Instrument decisions and prepare response
For each call, record the authenticated principal, server identity, tool name, redacted arguments, policy decision, result status, latency and correlation ID. Alert on tool-definition changes, scope expansion, unusual destinations, repeated failures, large outbound responses and access outside normal hours. Retain enough context to reconstruct an incident without retaining credentials or unnecessary personal data.
Local stdio versus remote HTTP
Neither deployment is automatically safer. Score both against the same controls:
| Control | Local stdio | Remote HTTP |
|---|---|---|
| Identity and audience | OS process identity helps, but application authorization is still required. | Explicit token validation, issuer and audience checks are mandatory. |
| Isolation | Potential access to the host filesystem, processes and network; sandboxing is essential. | Server isolation limits blast radius, but the service may still reach internal systems. |
| Transport | Protected by local process boundaries, with risks from the host and launch environment. | Requires TLS, certificate validation and origin controls. |
| Supply chain | Package and launch command run directly on a client machine. | Central deployment is easier to inventory, but a compromised service affects many clients. |
| Replay and sessions | Short-lived process state can reduce exposure, but handles still need binding and expiry. | Implement explicit nonce, expiry and replay controls for network requests. |
| Human approval | Client UI must show the exact tool and arguments before high-impact actions. | Central policy can enforce approvals consistently, but must not silently broaden scope. |
A practical review checklist
- Is every enabled server on an approved inventory with a pinned version?
- Does the server validate issuer, audience, expiry, scopes and subject on every request?
- Are client and upstream tokens separate?
- Can a tool reach files, processes or networks outside its documented purpose?
- Are descriptions, schemas and results treated as untrusted content?
- Are write, payment, deletion and code-execution actions gated by explicit approval?
- Are paths, URLs, arguments, sizes and destinations validated server-side?
- Are local processes sandboxed with read-only mounts and egress restrictions?
- Are state handles unpredictable, expiring, user-bound and single-use where appropriate?
- Do logs include a correlation ID and policy result while redacting secrets?
- Is there an alert and revocation procedure for a changed tool or leaked credential?
What to do when something goes wrong
The client suddenly shows a new tool or changed description
Disable the server, compare its manifest with the approved copy, preserve logs and package metadata, and revoke credentials used by that server. Re-enable only after reviewing the exact change and rebuilding from a trusted version.
A tool attempts an unexpected file, URL or command
Deny the request at the server policy layer, not by asking the model to reconsider. Check for injection in the source content, inspect canonicalized paths and arguments, and review whether the tool’s identity has broader access than documented.
A token appears in logs or model context
Revoke and rotate it immediately, identify every system that received it, remove the exposure from retained logs where feasible, and replace the integration with short-lived scoped credentials. Add a regression test proving that redaction happens before logging and model presentation.
Repeated calls or unexplained outbound traffic appear
Use correlation IDs to identify the principal and tool, apply rate limits and egress blocks, check for replayed messages, and preserve relevant evidence. Temporarily disable the affected server or scope while investigating.
Using ScreenshotNeo as an MCP-connected capability
ScreenshotNeo is a website screenshot API and MCP server for developers. Its MCP tools include take_screenshot, get_page_info and capture_pdf, so it should receive the same least-privilege treatment as any other remote capability: approve the specific tools, restrict credentials to the intended workflow, and require confirmation before publishing or distributing captured material. The service is at https://screenshotneo.com.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
Or skip the browser setup
For a direct capture, call the API instead of maintaining browser automation:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for request options. It can remove cookie-consent banners, newsletter popups and chat widgets before capture; bot checks, blank pages, failed loads and cache hits are not billed, and each response reports its page verdict and billing status in headers. An MCP server lets AI agents take screenshots. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
How exposed is an MCP agent in practice?
OWASP’s MCPTox benchmark tested 20 LLM agents against more than 45 real-world MCP servers containing 353 tools in August 2025. It reported a 72.8% attack-success rate for o1-mini and said Claude 3.7 Sonnet had the highest refusal rate, still under 3%. These are benchmark results under those stated models, servers and test conditions, not a probability for every deployment. They do show why model refusal cannot replace authorization, validation and isolation.
MCP specifications, OAuth requirements and security guidance continue to evolve. Re-check the protocol version and implementation requirements whenever you upgrade a client or server, and reassess permissions after adding a tool.
Frequently Asked Questions
Can an MCP server read my files without an explicit file tool?
Only if the server process has operating-system access that allows it. A tool does not need to advertise a file browser to read files through its own code, which is why filesystem permissions, sandboxing and read-only mounts matter.
Is a local MCP server safe because it never leaves my computer?
No. Local code can still read local secrets, execute processes, contact internal services or be replaced through a dependency or configuration change. Treat local stdio as a privileged process and isolate it.
What is the fastest control to add first?
Inventory and disable unapproved servers, then revoke any credentials they used. Follow with server-side authorization and least-privilege scopes; these controls reduce exposure before deeper hardening.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
