MCP servers give your AI assistant new abilities: read your filesystem, query your database, call an API, run a shell command. That is the whole point of them. It is also the whole point of the risk.
When you install a normal browser extension, you at least see a permission prompt. When you add an MCP server to your AI coding assistant, you usually do not. You add a config entry, restart, and the assistant now has whatever access that server exposes. Most people never read the server's source to see what that actually is.
This matters more with AI-built or AI-suggested MCP servers specifically. If the assistant wrote the server for you, or you copied one from a repo you have not read closely, you have no independent confirmation of what it does versus what its description says it does.
Three patterns show up repeatedly:
None of this requires anyone to be careless in an obvious way. It is the same gap as any fast-shipped code: the server works, so it ships, and the access-scoping step that would normally happen in review gets skipped because there was no review.
Before you add an MCP server to a live setup, or before you point an existing one at anything real:
If you want a second check on what a repo, including one holding an MCP server, actually exposes in its history and current config, RepoFortify scans for exactly this kind of overlooked access. Free to try, no install required. The convenience of an assistant that can just do things is real. So is the fact that "can just do things" is a permission grant, whether or not anyone treated it like one.