Are MCP servers safe?

They are as safe as their code and the credentials you give them. Local servers run with your user's privileges, so verify the source, use least-privilege tokens, keep approvals on and sandbox where you can.

Do MCP servers refresh OAuth tokens on their own?

For remote servers, the MCP client (Claude Code, Cursor and others) holds the tokens and refreshes them. A refresh can't add scope beyond the original grant, but the refresh token keeps working until the vendor expires or revokes it, so treat disconnecting as two steps: Removed locally (clear or remove the server in your client) and Authorization revoked (revoke the app on the vendor's connected-apps page). Only the second stops the refresh token.

What permissions does an MCP server need?

It depends on the server. Connectory lists the documented auth method and scopes for each server; many vendors don't document scopes, which we mark as Not documented.

Index / Guides / Checklist

MCP security & permissions checklist

An MCP server acts with your credentials. This checklist turns the MCP specification's security guidance and the major clients' docs into steps you can follow before you click Allow.

Updated Oct 25, 2026 · 12 sources

§1Before you install

Verify the source. Prefer the vendor's official server or a known repository; every Connectory entry links to its official page and source.
Read the exact command for local servers. The MCP spec warns local servers can run arbitrary code with your privileges — watch for sudo, rm -rf, network calls or access to home directories and SSH keys.
Check what it can reach. A local server can touch your files and network; a remote server can do whatever the vendor's API allows for your account.

§2Credentials and scopes

Use the narrowest token you can: a fine-grained GitHub token for specific repos, a read-only database user, a restricted API key.
Request minimal OAuth scopes. The spec's scope-minimization guidance: start with low-risk read scopes and elevate only when needed. Claude Code lets you pin scopes with oauth.scopes; Cursor lets you set scopes in a static OAuth auth block.
Keep secrets out of committed files. Use ${env:NAME} in Cursor, ${VAR} in Claude Code's .mcp.json, bearer_token_env_var in Codex, or input variables in VS Code (VS Code-format mcp.json only; VS Code's portable mcpServers configs don't support input variables or env files).
Check each Connectory spec sheet's Scopes / permissions cell — where the vendor documents scopes we list them; where they don't, we say "Not documented".

§3OAuth token refresh

For a remote server, your MCP client is the OAuth client: it runs the sign-in, stores the access and refresh tokens, and uses the refresh token (if one was issued) to get new access tokens. The MCP authorization spec requires clients to keep refresh tokens confidential in transit and storage, and tells them not to assume a refresh token will be issued at all. It also says authorization servers SHOULD issue short-lived access tokens and MUST rotate refresh tokens for public clients. Local stdio servers sit outside this flow — the spec says they should take credentials from the environment, so the token advice under Credentials and scopes applies to them instead.

A refresh can't widen access. Under OAuth 2.0 (RFC 6749, section 6) a refresh request can't ask for scope the user didn't originally grant, and a replacement refresh token must carry the same scope as the one it replaces. The OAuth security best practice (RFC 9700, section 4.14) adds that refresh tokens must stay bound to the scope and resource servers the user consented to, and that a public client's refresh tokens must be sender-constrained or rotated. The catch is the other direction: a refresh token represents the full scope you granted and can keep minting access tokens until the authorization server expires or revokes it.

Client	Who refreshes	Clear a server's sign-in
Claude Code	Claude Code. Its docs say tokens are stored securely and refreshed automatically; on a `401` it refreshes the stored token, reconnects and retries once.	“Clear authentication” in the server's `/mcp` menu, or `claude mcp logout <name>`. `claude mcp remove` also deletes the OAuth tokens and client registration it stored for that server.
Cursor	Cursor supports OAuth for remote servers; its MCP docs don't describe where tokens are stored or how refresh works. Cloud Agents keep their own MCP sign-ins on Cursor's servers, separate from the sign-ins on your machine.	Signing out locally doesn't sign out Cloud Agents: open Customize and log out on the server's Cloud row. The CLI's `agent mcp disable <identifier>` stops a server loading or prompting for approval.

Pin scopes before the first sign-in. Every refresh can reuse whatever you grant, so set oauth.scopes in Claude Code or scopes in Cursor's auth block — see Credentials and scopes.
Removed locally — when you drop a server, clear it in your MCP client: use the “Clear a server's sign-in” column above (Claude Code's claude mcp logout / claude mcp remove, Cursor's local and Cloud log-outs). This deletes the client's copy of the tokens.
Authorization revoked — then open the vendor's connected-apps (authorized applications) page and revoke the grant. Revoking on the authorization server's side is what stops the refresh token from minting new access tokens; clearing the client alone is not enough, because the grant stays live at the vendor until it expires or is revoked (RFC 6749 and RFC 9700, above). Each Connectory connector page for an OAuth server has a “When you disconnect” section that links the vendor's revoke page when the vendor documents one.
Prefer vendors that publish access-token lifetimes and refresh-token rotation or expiry. If a vendor doesn't document them, assume the grant lasts until you revoke it.
Re-check granted scopes after a server update. A server can ask for more through the spec's step-up flow (an insufficient_scope challenge), and the client re-authorizes with the union of old and new scopes — read the consent screen rather than clicking through. Our status page flags entries whose auth-related docs changed.
Act on re-authentication prompts deliberately. Claude Code shows a notice pointing at /mcp when a server rejects the stored refresh token; sign in again only if you still use that server.

§4While it runs

Keep tool approval on for anything that writes. Cursor asks before MCP tool calls by default; Codex supports default_tools_approval_mode = "writes".
Limit tools. Codex has enabled_tools / disabled_tools; VS Code and Cursor let you toggle tools or servers off.
Sandbox local servers where possible — VS Code's per-server sandboxEnabled for stdio servers on macOS/Linux (not Windows), or run the server in a container.
Treat fetched content as untrusted. Claude Code's docs warn that servers fetching external content can expose you to prompt injection.
Re-verify after upgrades. Server READMEs change; our status page flags entries whose upstream setup docs changed.

§5If you build or host a server

Don't pass client tokens through to downstream APIs — the spec forbids accepting tokens not issued for your server.
MCP 2026-07-28 is stateless with no protocol sessions. If your server mints state handles (cart or workflow IDs passed back as tool arguments), make them secure random values, bind them server-side to the authenticated user, and never treat possession of a handle as authentication. Servers still on 2025-11-25 or earlier session IDs should follow that version's session-hijacking guidance.
For local Streamable HTTP servers, bind to 127.0.0.1 rather than 0.0.0.0, validate the Origin header on every request (403 if invalid) and require auth — or use stdio.

§6FAQ

Are MCP servers safe?: They are as safe as their code and the credentials you give them. Local servers run with your user's privileges, so verify the source, use least-privilege tokens, keep approvals on and sandbox where you can.
Do MCP servers refresh OAuth tokens on their own?: For remote servers, the MCP client (Claude Code, Cursor and others) holds the tokens and refreshes them. A refresh can't add scope beyond the original grant, but the refresh token keeps working until the vendor expires or revokes it, so treat disconnecting as two steps: Removed locally (clear or remove the server in your client) and Authorization revoked (revoke the app on the vendor's connected-apps page). Only the second stops the refresh token.
What permissions does an MCP server need?: It depends on the server. Connectory lists the documented auth method and scopes for each server; many vendors don't document scopes, which we mark as Not documented.

§7Sources

Sources checked Oct 25, 2026. Spot something out of date? Tell us.