Choosing MCP servers safely
An MCP server is a program you run locally, usually pulled straight from a package registry, often with your credentials in its environment. Treat installing one like adding a dependency, because that is exactly what it is.
What you are actually granting
A stdio server launched with npx runs as your user. It can read what you can read and reach the network. The mcpServers config also hands it whatever environment variables you list, which is frequently an API token.
There is no sandbox by default. The trust decision happens at install time.
What to check
Who publishes it. Vendor maintained servers, such as GitHub's or Stripe's, are the safest category. Official reference servers from the Model Context Protocol project are next. Community servers vary enormously.
Whether it is current. Several early reference servers, including the original GitHub, Postgres, and Slack ones, have been archived and replaced by vendor packages. An install command copied from an old blog post may fetch something abandoned.
The exact package name. Typosquatting is real on npm and PyPI. Copy the name from the project's own documentation, not from a search result.
What it asks for. A documentation lookup server that wants a filesystem path and a database URL is worth a second look.
Prefer narrow scope
Many servers take a scope argument. Use it.
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/you/projects/thisone"]
A read only mode is better still when offered. Postgres and MongoDB servers commonly support one:
"args": ["-y", "mongodb-mcp-server@latest", "--readOnly"]
A read only database connection cannot be talked into dropping a table, no matter what ends up in the context.
Credentials deserve their own thought
Give each server its own token, scoped to the minimum it needs, rather than reusing a personal token with full account access.
A GitHub token scoped to one repository limits the damage from a prompt injection to that repository. A token with repo and delete_repo across your whole account does not.
Rotate anything you have pasted into a config that ended up in a screenshot or a shared repository.
Remote servers are a different trade
HTTP and SSE servers run on someone else's infrastructure. Nothing executes on your machine, which removes one class of risk and adds another: your queries and results go to a third party.
For a public documentation service that is usually fine. For anything touching private code, read the provider's data policy first.
The honest position on this site
Every MCP entry here carries a tested flag meaning one specific thing: has it been personally installed and run. Most currently say false. They are listed because they are widely used and their install commands were checked against primary sources, not because they have been individually audited.
Popularity is real evidence. It is not the same as verification, and this site will not pretend otherwise.
A reasonable default
Start with the official reference servers and vendor servers for tools you already pay for. Add community servers when you have a specific need, after reading what they do.