MCP crossed from “interesting RFC” into “paste this server into your agent.”
GitHub READMEs, Discord drops, and one-click installs now ship tools that can read files, hit HTTP, and sometimes run shell. That is power. It is also the same surface that ate API keys in every other plugin ecosystem.
A Model Context Protocol server exposes tools and resources to a host (Claude Code, IDE agents, custom runtimes). The host decides which servers attach. The model decides which tools to call. Your job is everything between those two sentences: allowlists, auth, and blast radius.
Community servers move fast. Pin a commit or a release tag. “Latest” is how supply-chain surprises arrive.
run_shell, leave it off until you have a reason.
// sketch: only expose a subset of tools from an MCP server
const allow = new Set(["search_docs", "get_issue"]);
for (const tool of server.listTools()) {
if (!allow.has(tool.name)) continue;
host.registerTool(wrapWithAudit(tool));
}
| MCP server | In-repo tool adapter | |
|---|---|---|
| Speed to try | Fast | Slower |
| Versioning | External | Yours |
| Review | Often thin | PR-reviewed |
| Fit when | Shared protocol across hosts | Critical side effects |
Use MCP to explore and to standardize. Keep money movement, production deploys, and secret rotation in first-party adapters until the server has the same review bar as your services.
Blocking community servers slows experimentation. Opening them without a sandbox is how you buy someone else’s bug. The middle path is a staging host with fake credentials and a recorded allowlist, then promote servers the same way you promote libraries.
Which MCP servers in your stack could delete data today if the model asked nicely?