On this page
How do I check an MCP server before connecting it?
Check who maintains it, which program or service you will actually connect to, what access it needs and how you can take that access away later. Start with test data and the smallest set of permissions that still does the job.
A listing in a directory, a familiar logo or a demo that works does not show that a connection is safe.
What is an MCP server?
What an MCP server is.
MCP is the open standard that lets an AI assistant use a tool. An MCP server is the part in between: a small program on your Mac, or a service online, that offers the assistant actions in one tool, such as reading a file or opening a ticket, and carries them out when asked.
Each server you connect is access. It stays set up after the project ends, until someone removes it.
Name the access you are about to give.
An MCP server lets an assistant work with another tool. For a small agency, that could mean finding a document, reading an issue tracker or changing a client’s website. Those jobs carry very different consequences. So before you connect anything, finish this sentence.
“This assistant needs to do this task, using this account, for this project.”
If the task is reading a project brief, access to every client folder needs a reason. If the tool can publish, delete or send messages, decide when a person has to approve that first. Then check which controls the assistant and the service actually give you. A rule written into a prompt is not the same as a permission the tool enforces.
Is a rule in the prompt enough?
A rule in a prompt, and a permission.
A prompt is an instruction. The assistant usually follows it, but nothing in the tool stops it from doing something else.
A permission is set in the tool or at the service. The account simply cannot do what it was not allowed to do. When client data is involved, rely on the permission.
Check the supplier and the destination.
Follow the setup link from the supplier’s own website or documentation. Compare the package name, the publisher and the server address with those instructions. A configuration copied from a forum may point somewhere else entirely. Treat a server that runs on your Mac as software you install, and a remote one as a service you trust.
Look for a project that is still maintained, clear install instructions and a way to report security problems. Read what the service says about how it handles data. These checks reduce the doubt. None of them is a safety certificate. If the maintainer or the destination is unclear, ask a developer to review it before you connect a live client account.
before you connectthree questions
- sourceWho supplies the server, and where does it really point?
- scopeWhat can the connection read, change or send?
- exitHow will you remove the connection and the access behind it?
Local or remote. What is the difference?
Local and remote servers.
A local server is a small program that runs on your Mac. It can reach what your account on that Mac can reach, so treat it like any app you install.
A remote server is a service online, reached by its web address. What you send it leaves your Mac, so read how that service handles data before you send anything from a client.
Provider guidance: Model Context Protocol: security best practices
Make the first test small on purpose.
Use a test project, or sample data that is not sensitive. Where the service allows it, create a separate account or key with only the permissions the job needs. Do not reuse an administrator key just because it is already in your password manager. Check that the job works before you widen the access, and write down any restriction you had to loosen.
Say an assistant should summarise support issues. It can start with read access to one test project. It does not need to delete tickets or manage users. Watch which actions the assistant proposes. A request for more access than you expected is a reason to stop and understand the setup. It is not one more box to click through.
What is a key or a token?
Keys, tokens and grants.
A key or token is a long password that lets one tool act for you in another. A grant is the same idea, given by clicking allow in a sign in window. Whoever holds it can do what it allows, until it is revoked.
Keep keys in a password manager. Never paste them into a chat, a shared document or the worksheet below.
Know how to disconnect it before you rely on it.
Write down where the connection is set up, and where the access behind it is controlled. These are often two different places. Turning off the MCP server in an editor can stop that editor from using it, while the key at the service stays valid. Check the service’s own instructions for revoking a grant or replacing a key.
ending one connectiontwo places
- 1
Turn it off in the assistant.
The assistant stops using the connection. The key it used still works.
- 2
Revoke the key at the service that issued it.
Now the access has ended. Check that the old key no longer works.
Give each connection an owner and a review date tied to the project. Review it again when a tool changes a lot, a contractor leaves or the client changes what data you may use. Keep the name of the key in your record, never the key itself. A client handover should list these connections next to the ordinary user accounts.
Provider guidance: Claude Code: MCP security and trust
Keep the connection visible after setup.
cybee shows the AI tools installed on your Macs, the MCP connections set up in each one and the tool activity it recorded. That helps you find a connection you forgot, and ask who still needs it. Type /cybee in your connected assistant to see the questions you can ask, next to the security status of the Mac. cybee is itself a tool your AI assistant uses through MCP, so put the same questions to it. What leaves your Mac is listed on the security page.
This view does not certify a server from someone else, and it puts no limits on any agent. Nor does it prove that a configured connection was ever used. Use the list to guide your review. Then make the change in the tool itself, and check that it took effect. What you want is a useful assistant whose access you can explain.
saved on Ana’s MacBook Pro
Claude Codeproject_files
Cursorproject_docs
Codexold_demo
one connection, in plain words
AI toolCursor
connectionproject_docs
howA service online, reached by its address.
points todocs.example.com/mcp
activityNone recorded on this Mac.
what it showsIt was set up. Not that it was used.
next stepAsk Ana who still needs it.
Does cybee limit what an agent can reach?
What cybee does not do here.
It does not limit what an agent can reach. Choosing what each agent may reach is planned, not live. It does not vouch for a server someone else wrote. And it does not revoke or replace keys at the services that issued them.
It shows what is set up and what was recorded, so a person can make the call.
Review one MCP connection.
Review one connection in the context of its project. Record how it is set up, what activity was observed, the open questions and the owner’s decision. Keep keys and passwords out of the register. Counts are optional.
Blank CSVno sign upuse it with your own records
Record your findings in the downloaded file and leave unknowns open. You fill this template in by hand. It is not a cybee export, an automated assessment or a certification.
If the button does nothing, copy the eight prompts below into your own sheet. They are the whole worksheet.
Tick a prompt once you know the evidence it needs. Ticks stay in this tab and clear when you reload.
-
What job needs this connection, and who owns it?
- Collect
- Record the assistant, the project, the task it is meant for and the person responsible. Check whether the work still needs this connection.
- Keep the limit visible
- A familiar tool name or an old approval does not show that the business still needs it.
-
Who supplies the server, and where does it connect?
- Collect
- Compare the supplier’s documentation with the package or server that is actually set up, how it connects and where it points. Keep a reference that is safe to share, never an address with a key in it.
- Keep the limit visible
- A directory listing or a known logo does not verify the exact package or address in your setup.
-
Which account and permissions does it use?
- Collect
- Check at the service that issued the access: which account, which resources, which permissions. Record where that access is managed, without copying the key.
- Keep the limit visible
- The setup alone may not show what the connection can really do. cybee does not limit what each agent can reach. That control is planned, not live.
-
What can this connection read or change?
- Collect
- Name the folders, projects or parts of the service it can reach. Check the controls for actions such as publishing, deleting or sending, and who approves them.
- Keep the limit visible
- An instruction in a prompt does not prove that the assistant or the service actually blocks those actions.
-
Can the task work with less access?
- Collect
- Where the service allows it, test with a sample project, data that is not sensitive and limited permissions. Record the task you tested, the result and any extra access it needed.
- Keep the limit visible
- A successful test shows the result of that one task. It does not make every later request safe.
-
What activity was recorded, and what is still unknown?
- Collect
- Point to the records by time, tool, action and whether it was attempted or completed. Keep a connection that is only set up apart from an action that was attempted or completed.
- Keep the limit visible
- No record does not prove that nothing happened. Completed does not mean safe, and not every event is captured.
-
How would you end both the connection and its access?
- Collect
- Find where the assistant keeps the setup, and how the service revokes the grant or key. Name who can do each step, and who checks it.
- Keep the limit visible
- Turning off a connection is not the same as revoking its key. This worksheet does neither.
-
What is the decision, and when is the next review?
- Collect
- Record a person’s decision to keep, look into or remove the connection, with the reason, the owner and the next review date or event. Check any change it leads to separately.
- Keep the limit visible
- A planned removal is not a finished one. Review the decision again when the project, the people, the server or the permissions change.
All eight prompts are marked as reviewed. Check your records and any open gaps before you share an answer.
Technical background: Model Context Protocol: security best practices
Where an editor keeps its servers: Visual Studio Code: add and manage MCP servers
Template by cybee · revised 24.09.2026. The article and its sources explain the method.
What to remember.
- Check the supplier and where the server really connects.
- Test with limited access and data that is not sensitive.
- Write down how to remove the connection and the access behind it.
Sources and further reading.
Product scope and provider guidance can change. Check the linked source for your own setup. Stuck on a word? Look it up in the security glossary.
Put it to work.
See which AI tools are on your Macs, what each one is connected to and what it was recorded doing.
