practices
ranked
21 Oct 2026
Five popular MCP servers, read for their defaults rather than their features
The protocol says command execution through its stdio transport is not a vulnerability. That pushes the entire security question down into each server's defaults, so I went and read them.
By Purvansh Parmar
Checked 2026-10-21
Read 9 min
Entries 5
There is a particular kind of security review nobody does on these things: install it, change nothing, and write down what you just agreed to. Everyone reads the feature list. Almost nobody reads the row in the environment variable table that says what the bind address defaults to, or the sentence in SECURITY.md admitting that the directory allowlist does not cover the terminal tool. So I did that for five of the most installed MCP servers on GitHub, and the pattern that came out of it was not that these projects are careless. Several are unusually honest. The pattern is that the safe default and the way you will actually run it are two different things.
How this was checkedPulled the current star counts and push dates for the top MCP repositories from the GitHub API, then read the documentation of five of them for one thing only: what happens if you install it and change nothing. Found a hardened bind default that the project's own Docker image opts out of, a directory allowlist that the project documents as not covering terminal commands, and a configuration setter exposed to the model as a callable tool. Nothing here is an undisclosed flaw. Every line of it is in the projects' own docs.
What I compared on
- what the server does with no configuration at all
- whether the documented safe default survives the project's own container image
- whether the thing that constrains the model is reachable by the model
The specification repository's own SECURITY.md, which defines what the protocol will and will not treat as a flaw.
Wins
It is explicit, which is worth a great deal. A section titled Behaviors That Are Not Vulnerabilities tells you exactly where the standard stops and your own threat model has to start, and it states plainly that a local server is trusted like any other software you install.
Loses
It resolves the question by declaring it out of scope. Reports about arbitrary command execution via stdio transport configuration, in clients or SDKs, are explicitly not eligible, so every mitigation you want has to come from the server you chose or the sandbox you put it in.
9,495 stars4 stated trust assumptions0 eligible reports for stdio command execution
Gives the model terminal control and filesystem access on your machine, with a configurable directory allowlist.
Wins
The most honest security document in this set. It calls itself an amplifier of whatever the connected client asks for, states that its restrictions are guardrails rather than a sandbox, and its own table marks symlink traversal prevention as not implemented.
Loses
The allowlist does not do what its name suggests: the project documents that allowedDirectories restricts filesystem operations only, and that terminal commands can still reach files outside them. set_config_value is also exposed as a tool, so the model can edit teh list that constrains it, which is why the docs advise changing configuration in a separate chat window.
10,084 starsallowedDirectories covers 1 of 2 pathssymlink prevention: no
The official testing tool for MCP servers, with a web backend that spawns processes on request.
Wins
Properly hardened on the command line. HOST defaults to 127.0.0.1, every /api/ route is guarded by a bearer token generated fresh per launch, and an all-interfaces bind is refused outright rather than warned about.
Loses
The refusal is lifted by DANGEROUSLY_BIND_ALL_INTERFACES, and the documentation notes that the project's Docker image sets it. Secrets are another two tier story: OAuth tokens and stdio env values go to the OS keychain where one exists, and to an unencrypted file under the home directory where one does not, which covers headless boxes, SSH sessions and containers.
11,112 stars127.0.0.1 defaultunencrypted fallback on keychain-less hosts
Microsoft's browser automation server, the most starred genuine MCP server on GitHub.
Wins
The default is right: the server binds localhost unless told otherwise, and the host flag is documented in the same table as everything else rather than buried in a security appendix.
Loses
The containerised recipe in the same README runs it with the host set to all interfaces and the browser sandbox disabled. Both are defensible inside a container and neither is flagged, so the copy and paste path hands you the two settings you would have been warned about on the command line.
38,458 starslocalhost default0.0.0.0 plus no-sandbox in the Docker recipe
GitHub's official server, which hands an agent your repositories, issues and pull requests through a token.
Wins
Read-only mode is a real, well implemented feature rather than a note in the docs: a single flag, and it takes priority over any explicit tool selection, so it cannot be partially undone by another argument.
Loses
It is opt in. Install it the way the quickstart shows and the agent has your write tools from the first prompt, with the blast radius set by the token you pasted rather than by anything the server decided.
33,816 starsread-only is 1 flagwrite enabled by default
Side by side
| Stars | Default posture | The catch |
|---|
| MCP trust model | 9,495 | documents the boundary | stdio execution is out of scope |
| Desktop Commander | 10,084 | guardrails, stated as such | allowlist misses the terminal |
| MCP Inspector | 11,112 | loopback plus token auth | Docker image opts out |
| Playwright MCP | 38,458 | binds localhost | Docker recipe binds everything |
| GitHub MCP Server | 33,816 | read-only available | not the default |
Verdict
Read Desktop Commander's SECURITY.md before you install anything else in this category, including things you consider safer. It is the only one of the five that writes down what its own controls cannot do, and the sentence admitting that path restrictions can be circumvented by shell substitution or another interpreter tells you more about the real threat model than any feature list will. Then do the same audit on whatever you are about to install, because it takes ten minutes: check the bind default, check whether the container image overrides it, and check whether the configuration is reachable as a tool. The answer to the third one is the one that will surprise you.
Sources