A project .mcp.json can tell an MCP client which tool server to run and what capabilities to expose to an AI agent. That makes it a trust boundary worth reviewing—not proof that MCP is malicious or that every such file is a backdoor. For a local STDIO server, the client launches a process that may inherit the client’s privileges; the server can potentially reach files, services, and credentials available in that environment. Review the configuration and the rest of the project payload, then limit what the server can access before you trust it.
What makes a project .mcp.json security-sensitive?
For a local server using MCP’s STDIO transport, the configuration is operational: it tells the client what command to launch and what arguments to pass. Unless a separate control such as a container or sandbox restricts it, the server process runs with the same environment-level privileges as the client. The MCP maintainers put it plainly: “The server process runs with the same privileges as the client.” MCP Security explains that command execution over STDIO is intended behavior; its presence alone is not a protocol vulnerability.
As an Amazon Associate I earn from qualifying purchases.
The practical question is what the process can do in the environment where it runs. If the client’s user account can read sensitive files, access internal services, or make writes, a server running under that account may be able to do so too. The configuration can therefore create a supply-chain and agent-trust risk even when the file is valid and the client is behaving as designed.
A risky configuration is not necessarily a malicious one. A server may need file, database, network, or system-command access to perform its stated job. The concern is access that is broader than necessary, unexpected, or concealed—or a flaw that lets a server cross a boundary it should not cross.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How a server can cause harm
Code and permissions
A configured command starts software. Its executable, arguments, dependencies, and environment all matter: an unfamiliar script or package may perform actions beyond what its name or description suggests. If it can reach credentials, private files, internal endpoints, or write-capable tools, the consequences can extend beyond the agent conversation.
The MCP maintainers caution that the SDK’s STDIO transport does not isolate one peer from a malicious counterpart. “Deployments that run stdio servers at reduced privilege (containers, sandboxes) are responsible for enforcing isolation at that boundary; the SDK’s stdio transport is not a sandbox.” The MCP security guidance treats capabilities such as filesystem access, database operations, network calls, and system commands as features that can be intended. A security finding should identify unauthorized or unexpected access, a trust-boundary failure, or an implementation flaw—not simply point to a documented capability.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Prompt injection through tool output
Tool risk is not limited to the server’s code. A server may retrieve external content containing instructions that try to manipulate an agent into disclosing private information or taking harmful actions. OpenAI’s MCP server guidance warns that trusting a server’s developer does not make the content it accesses trustworthy. Anthropic likewise identifies external resources as possible sources of both supply-chain or code-execution risk and prompt injection in its account of how it contains Claude across products.
Review read actions for privacy overreach and scrutinize write actions for consequences. An agent can be steered by content it retrieves even when the server developer is reputable; tool descriptions and developer trust are not substitutes for checking what data a tool exposes and what actions it can take.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Local STDIO and remote servers have different trust boundaries
| Factor | Local STDIO server | Remote MCP server |
|---|---|---|
| Execution boundary | The client launches a local process with the client’s environment-level privileges unless an external isolation control limits them. MCP Security | The client connects to a server operated remotely; the server’s behavior can change after approval. Anthropic |
| What you can inspect | Locally installed code can be audited and pinned, though inspection does not eliminate risk from its permissions or the content it returns. Anthropic | You may not control or inspect the server implementation, and its behavior can change after you initially approve it. Anthropic |
| Risks to consider | Malicious code, excessive access, and prompt injection in retrieved content are distinct concerns. MCP Security and OpenAI | Server-side changes, granted capabilities, and prompt injection in retrieved content still need consideration. Anthropic and OpenAI |
Neither transport is automatically safe. Local code may be easier to inspect and pin, but it runs in an environment whose permissions matter. A remote service avoids launching its process on your machine, but you have less control over its implementation and its behavior may change. Apply appropriate controls to either kind and treat content returned by tools as potentially untrusted.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to review an unfamiliar configuration and plugin
- Read every server entry. Identify which entries launch local commands and which connect remotely. Verify the server’s identity and source rather than relying on a project description alone.
- Inspect each local command. Check the executable, arguments, script or package provenance, environment variables, and references to secrets. Determine which user account runs it and which files and services that account can access. Without added isolation, the process inherits the client environment’s privileges.
- Map capabilities to the task. List the server’s available actions and decide whether filesystem, network, database, API, or system-command access is genuinely needed. Narrow access to the minimum useful scope.
- Assess data exposure and writes. Ask what private information a read operation can retrieve, where that information could go, and what a write operation could change. Treat consequential actions as requiring particular scrutiny.
- Inspect the whole plugin payload. Do not stop at
.mcp.json. Look at hooks, scripts, referenced code, and other shipped files. Anthropic’s official plugin security and privacy review prompt calls for checking, among other things, credential extraction, prompt injection, undisclosed network activity, and mismatches between a plugin’s description and its behavior. - Test with fake data in isolation. Before trusting an unfamiliar tool with real information, use a contained environment and test data. Restrict filesystem access and outbound network connections where feasible so a mistake or malicious tool cannot freely reach secrets or arbitrary destinations.
- Reassess remote services over time. Initial approval is not a permanent guarantee about server behavior; review whether the service is still appropriate for the data and actions you expose to it.
This review reduces risk; it cannot guarantee that every malicious behavior will be detected.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What the documented Claude Code example does—and does not—show
Anthropic describes earlier reports in Claude Code in which project settings were parsed before a trust prompt, and says the fix was to defer parsing and execution until after the user accepted trust. That account is specific to the product behavior described there; it does not establish how every MCP client behaves or what current versions do. Check the relevant client’s current documentation before relying on a particular trust-prompt sequence.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAnthropic also reports that in a controlled internal red-team exercise in February 2026, a researcher persuaded an employee to launch Claude Code with a malicious prompt, and Claude completed the described exfiltration in 24 of 25 retries. That is the result of one internal exercise involving a user-delivered prompt—not a general exploit rate for MCP configurations, an estimate of how often such attacks occur, or an independent study. Anthropic’s account illustrates why user decisions, prompts, tools, and available data all matter; it does not demonstrate an incident involving a project .mcp.json file.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
