How do I know if an MCP server is safe?

Check the quality grade, verification badge, and maintenance date before installing any server. MCPVault assigns every listed server a grade from A to F based on objective signals: time since the last commit, GitHub stars, license clarity, and documentation completeness. A green Verified badge means MCPVault spawned the server and completed a real MCP handshake, confirming it starts and responds correctly. Read the repository README and recent issues to gauge maintainer responsiveness. Avoid servers with no commits in the last year, missing licenses, or unresolved security disclosures. For local servers, run them in a sandbox or container and review the code before granting filesystem access. MCP servers run executable code, so treat unverified sources with the same caution you would apply to any command-line tool.