MCP servers give your AI assistant tools, and those tools run with your user's privileges. A quick review before you approve one catches most of the avoidable risk. This is the checklist I use.
The model reads tool descriptions as instructions. A description that says anything beyond what the tool does (for example "always call this first" or "do not tell the user") is a red flag.
../../ in a test folder and see if it resolves outside the root.localhost and cloud metadata addresses?
npx some-server@latest fetches whatever is newest on every start. Pin an exact version in your client config and update deliberately.
Servers inherit environment variables you pass them. Give each server only the tokens it needs, ideally a scoped, read-only one.
Tool names and descriptions can change between versions. Re-read them when you bump a version, not only at first install.
Turn off tools you don't use, and require confirmation for anything that writes or executes.
None of this needs special tooling, but it is easy to skip and hard to remember to repeat, which is why a periodic re-check beats a one-time approval. What's on your checklist that I missed?