# Is it safe to connect this tool to your AI assistant? Five checks first. > Check who supplies an MCP server, what it can reach and what it was recorded doing. Then note the evidence and an owner’s decision in the blank register. Page: https://cybee.ai/blog/mcp-server-security/ (MCP security checklist and review worksheet) - [Blog](https://cybee.ai/blog/) - MCP server review AI tools An MCP server gives an AI assistant a way into another tool: client files, a database, a website. Before you connect one, check who supplies it, what it can reach and how you would switch it off again. By [cybee](https://cybee.ai/about/#founders) Published 21.09.2026 Updated 24.09.2026 6 minute read, plus the worksheet Jump to the worksheet In one minute - An MCP server lets an AI assistant use another tool, such as a project folder, a database or a client’s website. Every connection is access. - Before you connect, finish one sentence: this assistant needs to do this task, using this account, for this project. - Take the setup from the supplier’s own instructions. Test on sample data with the least access that works. - Switching a connection off in the assistant does not cancel the key behind it. That happens at the service that issued it. - cybee lists the AI tools and connections on your Macs, free. It shows what is set up. It does not limit what an agent can reach. ## How do I check an MCP server before connecting it? Check who maintains it, which program or service you will actually connect to, what access it needs and how you can take that access away later. Start with test data and the smallest set of permissions that still does the job. A listing in a directory, a familiar logo or a demo that works does not show that a connection is safe. **Q:** What is an MCP server? ### What an MCP server is. MCP is the open standard that lets an AI assistant use a tool. An MCP server is the part in between: a small program on your Mac, or a service online, that offers the assistant actions in one tool, such as reading a file or opening a ticket, and carries them out when asked. Each server you connect is access. It stays set up after the project ends, until someone removes it. [AI agents on your Macs](https://cybee.ai/product/ai-agents/) ## Name the access you are about to give. An MCP server lets an assistant work with another tool. For a small agency, that could mean finding a document, reading an issue tracker or changing a client’s website. Those jobs carry very different consequences. So before you connect anything, finish this sentence. > “This assistant needs to do this task, using this account, for this project.” If the task is reading a project brief, access to every client folder needs a reason. If the tool can publish, delete or send messages, decide when a person has to approve that first. Then check which controls the assistant and the service actually give you. A rule written into a prompt is not the same as a permission the tool enforces. **Q:** Is a rule in the prompt enough? ### A rule in a prompt, and a permission. A prompt is an instruction. The assistant usually follows it, but nothing in the tool stops it from doing something else. A permission is set in the tool or at the service. The account simply cannot do what it was not allowed to do. When client data is involved, rely on the permission. ## Check the supplier and the destination. Follow the setup link from the supplier’s own website or documentation. Compare the package name, the publisher and the server address with those instructions. A configuration copied from a forum may point somewhere else entirely. Treat a server that runs on your Mac as software you install, and a remote one as a service you trust. Look for a project that is still maintained, clear install instructions and a way to report security problems. Read what the service says about how it handles data. These checks reduce the doubt. None of them is a safety certificate. If the maintainer or the destination is unclear, ask a developer to review it before you connect a live client account. Figure: Three questions to answer before anything is connected. Nobody ticks these for a score. **Q:** Local or remote. What is the difference? ### Local and remote servers. A local server is a small program that runs on your Mac. It can reach what your account on that Mac can reach, so treat it like any app you install. A remote server is a service online, reached by its web address. What you send it leaves your Mac, so read how that service handles data before you send anything from a client. Provider guidance: [Model Context Protocol: security best practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices) ## Make the first test small on purpose. Use a test project, or sample data that is not sensitive. Where the service allows it, create a separate account or key with only the permissions the job needs. Do not reuse an administrator key just because it is already in your password manager. Check that the job works before you widen the access, and write down any restriction you had to loosen. Say an assistant should summarise support issues. It can start with read access to one test project. It does not need to delete tickets or manage users. Watch which actions the assistant proposes. A request for more access than you expected is a reason to stop and understand the setup. It is not one more box to click through. **Q:** What is a key or a token? ### Keys, tokens and grants. A key or token is a long password that lets one tool act for you in another. A grant is the same idea, given by clicking allow in a sign in window. Whoever holds it can do what it allows, until it is revoked. Keep keys in a password manager. Never paste them into a chat, a shared document or the worksheet below. ## Know how to disconnect it before you rely on it. Write down where the connection is set up, and where the access behind it is controlled. These are often two different places. Turning off the MCP server in an editor can stop that editor from using it, while the key at the service stays valid. Check the service’s own instructions for revoking a grant or replacing a key. 1 2 Figure: Two steps, in two places. After the first one alone, the key still works. Give each connection an owner and a review date tied to the project. Review it again when a tool changes a lot, a contractor leaves or the client changes what data you may use. Keep the name of the key in your record, never the key itself. A client handover should list these connections next to the ordinary user accounts. Provider guidance: [Claude Code: MCP security and trust](https://code.claude.com/docs/en/mcp) [Who still has your client’s API keys?](https://cybee.ai/blog/client-api-key-handover/) ## Keep the connection visible after setup. cybee shows the AI tools installed on your Macs, the MCP connections set up in each one and the tool activity it recorded. That helps you find a connection you forgot, and ask who still needs it. Type /cybee in your connected assistant to see the questions you can ask, next to the security status of the Mac. cybee is itself a tool your AI assistant uses through MCP, so put the same questions to it. What leaves your Mac is listed on [the security page](https://cybee.ai/security/). This view does not certify a server from someone else, and it puts no limits on any agent. Nor does it prove that a configured connection was ever used. Use the list to guide your review. Then make the change in the tool itself, and check that it took effect. What you want is a useful assistant whose access you can explain. Figure: What a configured connection shows. No recorded activity does not prove it was never used. **Q:** Does cybee limit what an agent can reach? ### What cybee does not do here. It does not limit what an agent can reach. Choosing what each agent may reach is planned, not live. It does not vouch for a server someone else wrote. And it does not revoke or replace keys at the services that issued them. It shows what is set up and what was recorded, so a person can make the call. Free for every Mac The list of AI tools, their connections and the recorded activity are part of the free plan, next to protection and the 118 checks. [See what the Proof plan adds](https://cybee.ai/pricing/). [What a configured connection shows](https://cybee.ai/product/ai-agents/#mcp-connection-evidence) ## Review one MCP connection. Review one connection in the context of its project. Record how it is set up, what activity was observed, the open questions and the owner’s decision. Keep keys and passwords out of the register. Counts are optional. Blank CSV no sign up use it with your own records Record your findings in the downloaded file and leave unknowns open. You fill this template in by hand. It is not a cybee export, an automated assessment or a certification. If the button does nothing, copy the eight prompts below into your own sheet. They are the whole worksheet. ### What job needs this connection, and who owns it? Collect Record the assistant, the project, the task it is meant for and the person responsible. Check whether the work still needs this connection. Keep the limit visible A familiar tool name or an old approval does not show that the business still needs it. ### Who supplies the server, and where does it connect? Collect Compare the supplier’s documentation with the package or server that is actually set up, how it connects and where it points. Keep a reference that is safe to share, never an address with a key in it. Keep the limit visible A directory listing or a known logo does not verify the exact package or address in your setup. ### Which account and permissions does it use? Collect Check at the service that issued the access: which account, which resources, which permissions. Record where that access is managed, without copying the key. Keep the limit visible The setup alone may not show what the connection can really do. cybee does not limit what each agent can reach. That control is planned, not live. ### What can this connection read or change? Collect Name the folders, projects or parts of the service it can reach. Check the controls for actions such as publishing, deleting or sending, and who approves them. Keep the limit visible An instruction in a prompt does not prove that the assistant or the service actually blocks those actions. ### Can the task work with less access? Collect Where the service allows it, test with a sample project, data that is not sensitive and limited permissions. Record the task you tested, the result and any extra access it needed. Keep the limit visible A successful test shows the result of that one task. It does not make every later request safe. ### What activity was recorded, and what is still unknown? Collect Point to the records by time, tool, action and whether it was attempted or completed. Keep a connection that is only set up apart from an action that was attempted or completed. Keep the limit visible No record does not prove that nothing happened. Completed does not mean safe, and not every event is captured. ### How would you end both the connection and its access? Collect Find where the assistant keeps the setup, and how the service revokes the grant or key. Name who can do each step, and who checks it. Keep the limit visible Turning off a connection is not the same as revoking its key. This worksheet does neither. ### What is the decision, and when is the next review? Collect Record a person’s decision to keep, look into or remove the connection, with the reason, the owner and the next review date or event. Check any change it leads to separately. Keep the limit visible A planned removal is not a finished one. Review the decision again when the project, the people, the server or the permissions change. Technical background: [Model Context Protocol: security best practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices) Where an editor keeps its servers: [Visual Studio Code: add and manage MCP servers](https://code.visualstudio.com/docs/agent-customization/mcp-servers) Template by cybee · revised 24.09.2026. The article and its sources explain the method. ## What to remember. - Check the supplier and where the server really connects. - Test with limited access and data that is not sensitive. - Write down how to remove the connection and the access behind it. ## Sources and further reading. - [Model Context Protocol: security best practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices) - [Claude Code: MCP security and trust](https://code.claude.com/docs/en/mcp) Product scope and provider guidance can change. Check the linked source for your own setup. Stuck on a word? [Look it up in the security glossary](https://cybee.ai/glossary/). ## Put it to work. See which AI tools are on your Macs, what each one is connected to and what it was recorded doing. [AI agents on your Macs](https://cybee.ai/product/ai-agents/) On this page - The short answer - Name the access you give - Check the supplier - Test small first - Know how to disconnect it - Keep it visible - The worksheet - What to remember - Sources cybee Lists the AI tools on your Macs and what each one is connected to. Free for every Mac. [See how it works](https://cybee.ai/product/ai-agents/) ## Every connection is access. Three more guides. [AI tools Which AI tools are on your work Mac? List the assistants, the connections set up in each one and who still needs them. Read the guide](https://cybee.ai/blog/ai-tool-inventory/) [your team Who still has your client’s API keys? Keys in scripts, automations or AI tools at a handover: what to keep, what to replace and what to remove. Read the guide](https://cybee.ai/blog/client-api-key-handover/) [Workspace Which apps can read your company’s Google Drive? Review forgotten app permissions in Google Workspace without stopping useful work. Read the guide](https://cybee.ai/blog/google-workspace-app-access/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)