You added an MCP server to your AI assistant. Did you check what it can touch?

Adding an MCP server to your AI assistant brings new capabilities like reading your filesystem, querying databases, calling APIs, and executing shell commands. However, with these powerful abilities come significant risks. When you install a normal browser extension, you typically receive a permission prompt, but adding an MCP server to your AI coding assistant often goes unnoticed.

Most users do not read the server's source code to understand what access it exposes. This is particularly concerning when the assistant has generated or recommended the server itself. There are three common patterns that lead to security breaches: a server with read access gaining write permissions, a server interacting with an external API embedding credentials directly, and a server meant for local development being repurposed for production use without re-evaluating its commands.

These issues arise from the rush to ship code without thorough scoping of permissions. Before trusting an MCP server, it is crucial to examine what the server can actually do. Examine the tool definitions it exposes, not just its stated purpose. Check where credentials are stored and ensure they are not hardcoded. Grant only the minimum permissions required for the server's intended task.

If you did not write the server, treat it with the same scrutiny you would give a new software dependency. Tools like RepoFortify can automatically scan repositories for overlooked access permissions. While the convenience of an AI assistant that can perform tasks is undeniable, it is equally important to recognize that granting broad capabilities is a significant permission grant, whether intentional or not.