AdYour product here, seen by people installing AI tools every day
AI Plugin Index
Sponsor slots open: 12 of 12, from $249 a month

Are MCP servers and skills safe?

MCP servers and skills are as safe as their code and their author. They can read files, call APIs and run commands, so a malicious or careless one can leak data. Before installing, check the author, recent activity, what access it asks for, and whether its instructions contain anything hidden.

The main risks

  • Too much access: a server that can read your whole disk or every repo when it only needs one folder.
  • Hidden instructions: text inside a skill or tool description that tries to make the assistant do something you did not ask for (prompt injection).
  • Download and run: setup steps that fetch and execute code from the internet.
  • Abandoned code: no updates for a long time means known problems stay unfixed.

A 5-point check before installing

  1. Who made it? Prefer official servers from the vendor, or authors with a track record.
  2. Is it maintained? Look at the last commit date. Every listing here shows it.
  3. What does it ask for? Read which tools and permissions it exposes.
  4. Read the SKILL.md or README. Anything you do not understand is a reason to wait.
  5. Give it the least access possible: scoped API keys, read-only where you can.

This directory only lists projects with an active, original GitHub repository, and we are adding automated security grades to every listing.