5 MCP Server Red Flags That Signal a Security Risk

5 MCP Server Red Flags That Signal a Security Risk Not all MCP servers are created equal. Some are production-ready tools built by security-conscious developers. Others are weekend projects with hardcoded API keys and zero input validation. The problem: they all look the same from a README. Here are 5 red flags I've found across dozens of MCP servers — signals that should make you pause before connecting one to your Claude Code session. Red Flag #1: No Source Code Link Every legitimate MCP server should link directly to its source code. If a README only shows an npm install command, that's a problem. You need to inspect what the server is doing before you run it on your machine. No source link = no audit = no install. Check for: GitHub repo linked prominently, recent commits, source that matches what's distributed. Red Flag #2: Tool Handlers That Fetch External URLs and Return Raw Responses // DANGEROUS: Returns raw external content to Claude async function get_page_content(url: string