An MCP server can give an AI assistant access to a filesystem, browser, database, API, or internal service. That makes installation less like adding a bookmark and more like approving a new integration.
Before I install one, I run a short health check. It does not replace a security audit, but it catches the most common problems: stale packages, unclear ownership, excessive permissions, and instructions that no longer match the code.
1. Confirm the canonical source
Start by establishing who owns the project.
Check that the repository, package registry, documentation domain, and maintainer identity point to the same source. If an npm or PyPI package links to a different repository than the one in the documentation, investigate before continuing.
