Free tool: runs in your browser
MCP server install checklistbefore you add an MCP server to an AI client
TimeBinder adds a layer of protection against AI and human fraud and disputes. Check where the server comes from, who owns the repository now, how the client launches it, what it can reach, and the dated copies you can still show.
Nothing you tick is sent anywhere. This page cannot scan a server or tell you whether one is safe. It is not security advice. The reports it mentions describe specific findings, not every server.
Check the source, the launch command, the access and the copies you can still show
Tick what is true about the server you are about to install. You get a shareable result and clear next steps. Nothing you tick is sent to TimeBinder.
Your choices stay on this page. Nothing you tick is sent anywhere or tied to your name.
Tick everything that is true about an MCP server you are about to install
This looks at where an MCP server comes from, who owns the repository now, how the client launches it, what it can read and what you would rotate if it turned out to be bad. It is not a scanner and cannot tell you whether a server is safe.
What to do now
What should I check before installing an MCP server? The short answer
Check where the server really comes from before you let an AI client start it. Open the repository the listing points to and confirm it exists and who owns it now. Pin the exact version instead of fetching the latest each time. Read the package manifest for install scripts. Give it the narrowest token you can and write down what it could read. Reports from 10 to 12 November 2026 describe two reasons: researchers at TrendAI said that more than 900 dead links in four MCP directories pointed to deleted GitHub accounts whose names anyone can register, and a vulnerability database listed three npm packages named like MCP servers as malware. For the two packages GitHub flagged, its guidance was to treat any computer that installed them as fully compromised.
This checklist cannot scan a server or tell you whether one is safe. A TimeBind of a file you already hold, such as your client config or a lockfile, can show that exact file existed no later than a recorded time and still matches. It does not show that a server is safe or that nothing ran.
Why this came up in November 2026
On 10 November 2026 TrendAI published research in which it health-checked more than 90,000 GitHub URLs listed across four MCP directories. It reported that roughly 8% were dead, and that more than 900 of those dead links pointed to deleted accounts whose usernames anyone can register. It said that it did not find evidence that the directories it examined routinely validate link health, and it warned that AI agents that install servers on their own make the problem worse because nobody reads the README. These are the researchers’ findings, and this page does not treat them as more than that.
The same week, VibeVulns reported that three npm packages named like MCP servers or MCP tooling were reported as malware between 10 and 12 November 2026. It says GitHub’s advisories for two of them advise treating any computer that installed them as fully compromised, and that the third declares its only dependency as an unpinned tarball fetched over plain HTTP from a bare IP address. A separate write-up from Invariant Labs describes how a malicious public GitHub issue could steer an agent that uses the GitHub MCP server into leaking private repository data, and says the fix is at the agent-system level, for example by limiting which repositories the agent can reach.
Measured demand is real but technical. Checked on 13 November 2026, about 4:30 AM Australia/Brisbane. Google autocomplete for “mcp server security” returned “mcp server security best practices”, “mcp server security risks”, “mcp server security scanner” and “mcp server security issues”. Autocomplete shows what people type. It is not search volume.
Sources: TrendAI, 10 November 2026, VibeVulns, 12 November 2026 and Invariant Labs.
What this checklist does and does not do
The honest job of this page is to put the checks in a sensible order before you install, not to audit any server. If you installed something you now doubt, see the npm package compromise response checklist. See also the glossary entries for existed no later than and fingerprint.
| Part | What it does | What it does not do |
|---|---|---|
| The source | Reminds you to open the repository behind a listing, check the owner and compare the name with the publisher you expect. | Verify a repository or tell you whether an owner changed. |
| The launch command | Reminds you to pin an exact version, read the manifest for install scripts and avoid dependencies fetched from outside the registry. | Read a package for you or find malicious code. |
| Access and secrets | Reminds you to give the narrowest token, run the server away from your keys and write down what it could reach. | Tell you whether a secret was exposed. |
| A TimeBind of a file you already hold | Records that an exact file existed no later than a recorded time and still matches, using a SHA-256 fingerprint made in your browser. The file stays on your device. | Show that a server is safe, or that nothing ran. |
If your client config and lockfiles are something you may need to show later
Before you install or change a server:
- Keep dated copies of the client config, the pinned version and the source link you approved.
- Make a TimeBind of each exact file you already hold. The fingerprint is made in your browser and the file stays on your device. You can later download a Proof of Time Certificate.
- Store the files, the list of what each server can reach and the certificate together, with a note of when you approved each one.
A TimeBind shows the exact file existed no later than the recorded time and still matches. It cannot show that a server is safe.
First Pooled TimeBind free, no card, then from US$5. An ASAP TimeBind is US$15.
What a TimeBind shows, and what it does not. It shows that an exact file existed no later than a recorded time and that a copy shown later still matches its fingerprint. It does not show who made the file, who owns it, that its contents are true, or whether AI was used to make or edit it. This is general information, not legal advice.
If you are about to install or update an AI coding extension, see also the free AI coding extension install checklist. It cannot scan extensions or show that a machine is clean.
Once an agent has tools connected, the free AI coding agent session audit log helps you keep a plain record of each session: access, project and what you checked. It cannot make an agent safe.
MCP server install checklist: FAQ
Is a server listed in a directory safe?
Not by that fact alone. TrendAI reported that it found no evidence the directories it examined routinely validate link health or code at the listed URLs. Open the repository, check the owner and read what the server does.
Why pin the version?
A launch command that fetches the latest version each time can pull in a changed or replaced package. Pinning an exact version means you decide when it changes.
What if I already installed a package named in a malware report?
Follow the advisory for that package. The reports quoted here say to treat any computer that installed the flagged packages as fully compromised, rotate secrets from a clean computer and consider reinstalling. See the npm compromise checklist on this site.
Does a dated record show that a server is safe?
No. A TimeBind of a file you already hold, such as a client config, can show that exact file existed no later than a recorded time and still matches. It does not show that a server is safe.
Is this checklist a security audit?
No. It runs in your browser and only helps you plan the order of the checks. For a real incident, follow your organisation’s security process.
Is anything I tick sent to TimeBinder?
No. The checklist runs in your browser. Your ticks stay on the page.
Related guides and tools
- npm package compromise response checklistIf you already installed something you doubt
- AI agent file access checklistWhat an agent can read on your machine
- AI coding assistant settings file secrets checklistKeep secrets out of settings files
- GitHub Actions workflow lockfile checklistA neighbouring job for CI workflows
- Developer timestampingThe TimeBinder hub for developer file records
- GlossaryPlain definitions of fingerprint, SHA-256 and existed no later than
- All free toolsPrivate, in-browser tools
Date the exact files you already hold
Add a layer of protection against AI and human fraud and disputes: a dated, checkable record of the exact config and lockfiles you approved.
- Open the app and sign in with email or Google.
- Add your files. They stay on your computer.
- Seal them and download your Proof of Time certificates.
First Pooled TimeBind free, no card, then from US$5. See pricing.