Guide 8 · 4 min read · Checked Nov 11, 2026
5 checks before you install an MCP
About 2 minutes each: check its page on our site and the permission request in your AI app before you say yes.
The five checks
A ✓ followed by a domain means the maker proved they own that domain. It does not mean the company named on the card made it. A server called “Gmail” whose domain isn’t Google’s is made by someone else, and your email will pass through them.
On each server’s page, look at “Basic checks”. If there is a prompt injection warning, or its online address doesn’t respond, pick another one.
Look at “What it can do”. If it has tools that send, delete or pay, make sure your AI app asks you first every time.
A remote server sends data through the maker’s servers. A local one runs on your computer with the same rights as your account. Never give an unknown one access to your whole computer.
Never enter your main account password. If it needs an API key, create a separate key with the fewest rights, never paste it into a chat, and revoke it when you stop.
When your AI app asks for permission
- Read the tool’s name, what it will do, and to which data.
- If it wants to send, delete or pay for something you didn’t ask for, decline and stop that chat.
- Don’t switch on a tool that can send email or messages in the same chat where AI reads unknown websites or files. Text in them may secretly tell the AI to send your data out.
Done with it? Remove it properly
Remove the connector in your AI app’s settings, then revoke its access on that service’s account security page. If you created an API key, revoke that too.
Only servers with a verified domain (✓) →What MCP is and what it can do →