Save this checklist before you connect a new MCP server to your agent. A tool is a capability, so each check below asks what the agent can now do.
- [ ] Know the source. Read the server's code or its publisher before you install it. A server runs with your permissions.
- [ ] Scope it. Give it access to the one folder or service it needs, not your whole machine.
- [ ] Read every tool description. The agent chooses tools from these descriptions. A vague one leads to wrong calls.
- [ ] Separate read from write. Destructive tools should be obvious, and few.
- [ ] Require approval for irreversible actions. Deleting data, deploying, or changing production stays with a person.
- [ ] Log every call. You need to review what the agent did, after the fact.
- [ ] Limit the number of servers. Each one adds tools the agent must choose between.
- [ ] Test one call by hand. Confirm the server answers before you trust an agent with it.
- [ ] Keep it off the network. Local stdio servers should not listen on a port you did not intend.
- [ ] Review it on a schedule. Servers change. Check their updates and remove the ones you no longer use.
For a local stack, the TDK CLI server (tdk mcp) exposes doctor, up, down, status, logs, and resource_list. Start with doctor, and have the agent poll status until readiness is true.
Top comments (0)