Which risks really exist
The problems documented in 2026 are concrete, not theoretical. The main ones:
- Malicious or compromised servers. A server downloaded from an unknown source can do more than it claims. Tampered packages have already circulated: the server looks useful and meanwhile steals data.
- Prompt injection. Text hidden in a file or a web page that the AI reads can contain covert instructions ("send this data to..."). The AI, reading it, risks executing them. It's the number-one risk of these systems today.
- Too many permissions. A filesystem server to which you give the entire disk can read everything, including what's irrelevant. The more access you grant, the wider the damage if something goes wrong.
How to reduce the risks
From any assistant, the steps that matter are the same.
- Install only servers from reliable sources. Prefer official servers or those with many installations and verifiable public code. A server found at random is worth as much as a program downloaded from some random site: when in doubt, don't connect it.
- Give the minimum access. To a filesystem server indicate the precise folder needed, never the entire disk. The working syntax, in your assistant's configuration file:
{
"mcpServers": {
"documents": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/yourname/Documents/work"]
}
}
}
- Use read-only where you can. If you need the AI to read but not modify, choose a read-only configuration: the AI looks at the files but can't change or delete them.
- Keep a human confirmation for serious actions. Deleting data, sending emails, making payments: serious assistants ask for your go-ahead first. Don't disable these confirmations for convenience.
- Update the servers. Flaws are fixed with updates, as with any software.
A concrete example
Giulia wants the AI to analyze her clients' contracts. The temptation is to connect the filesystem server to the entire user folder, so it "sees everything." Instead she creates a subfolder with only the contracts to analyze and indicates that one in the configuration file, read-only. The AI reads what it needs and nothing else; it can't modify or delete anything. Even if one of the files contained a trap text, the possible damage is reduced to a minimum because the server doesn't have the permissions to do disasters. The convenience is the same, the risk much lower.
When NOT to use it (and what to do instead)
If the server comes from a source you don't know
If you don't know who wrote a server and can't verify its code, don't connect it to real data. Try it first on an empty folder or with fake files, and watch what it does, before giving it access to anything that counts.
If you have to handle very sensitive data
For third parties' personal data, health or financial data, consider whether the AI really has to see it. When possible, anonymize first (remove names and exact numbers) or keep that data out entirely. No configuration is as safe as a piece of data you haven't exposed.
If you don't understand what a permission does
If a configuration asks for an access you don't understand, stop. Ask the AI itself to explain to you in plain words what that line grants before saving it. A permission given without understanding it is the most common way to open a door you thought was closed.
A tip from someone who really uses it
Keep a list of the servers you've connected and, every now and then, remove the ones you no longer use. Every active server is an open door: the fewer you keep, the less surface you offer to a problem. Security isn't a one-time action at installation, it's a small maintenance you do by cleaning out what's not needed.
Frequently asked questions
Can an MCP server access my whole computer?
Only if you let it. A filesystem server sees exclusively the folders you indicate to it: if you give it a single folder, the rest of the disk stays invisible. The problem arises when, out of laziness, access to everything is granted.
How do I know whether a server is reliable?
Look at the source: official servers, public and inspectable code, many installations and an active community are good signs. A server with no visible code, no official page and no users is a risk not worth taking.
Is MCP dangerous and best avoided?
Here's the misunderstanding to clear up: MCP isn't any more dangerous than installing software on your computer is. It's a door, and a door is managed with the right locks, not by walling it up. Trusted servers, minimum permissions and human confirmations make everyday use safe. The danger is careless use, not the tool.