mcp-client-integrationlisted

# Consume an MCP Server Far more people install servers than write them, and installing one is the part with the risk. **An MCP server is code that runs on your machine, holds your credentials, and is invoked by a model that can be persuaded.** A friendly description is not a safety property. ## Evaluate Before Installing Five questions, cheapest disqualifier first. **1. Who publishes it?** A vendor publishing a server for their own API has a reputation at stake. An unaffiliated wrapper of that same API does not. Check whether the vendor ships one before reaching for a third-party copy. **2. What does it execute?** Read the install command. `npx some-server` fetches and runs code at every launch, resolving to whatever the registry serves that day. A pinned version or a vendored build is a different risk profile entirely. **3. What credentials does it want?** A server asking for a token scoped wider than its tools need is either careless or worse. A read-only integration should not require write scope. **4. What tools does it expose?** Install it, list the tools, and read them before wiring it into anything that matters. Look for destructive operations that are not annotated — that combination means the author did not think about the host's ability to gate them. **5. Is it maintained?** Last commit, open issues, whether it tracks SDK releases. An unmaintained server pinned to an old SDK is a dependency that will break on a protocol change nobody is watching for. ## Re