What is MCP?
Model Context Protocol is an open standard for connecting AI assistants to external tools and data sources. Anthropic introduced it in late 2024; the spec is now implemented by Claude, Cursor, Cline, and others. An MCP server exposes capabilities (read files, query a DB, send email) which a host runtime can invoke on the model's behalf.
Why it matters
Without MCP, every app re-invents tool integration. With MCP, one server (e.g. GitHub) works across every host. The tradeoff: the blast radius of a malicious or misconfigured server extends to every AI tool you run.
Five critical security risks
(1) Unrestricted shell exec. (2) Unscoped filesystem write. (3) Network egress for data exfiltration. (4) Third-party servers fetching remote code. (5) Over-permissive OAuth scopes that the agent can't self-restrict.
Best practices
Scope filesystem access to a single project root. Use read-only DB users. Keep shell and email servers in 'confirm' mode. Audit third-party servers the same way you audit npm dependencies — they run with your credentials.
If you wouldn’t give this server to a contractor, don’t give it to an agent.
Agents inherit every credential you hand them. A shell MCP is a keyboard on your machine; an email MCP is an outbox with your name on it; a crypto MCP is your wallet. Scope narrowly and default to read-only where possible.