How do I know if an MCP server is safe?

Check the quality grade, the security profile, the verification badge and the maintenance date before installing any server. MCPVault assigns every listed server a grade from A to F based on objective signals: time since the last commit, GitHub stars, license clarity, and documentation completeness. Claimed and verified servers also carry a weekly security profile from a static NVIDIA SkillSpector scan: which external services the code talks to, whether it reads environment variables in bulk, runs shell commands or touches other agents' configuration, and which dependencies have known advisories, each with file and line. A green Verified badge means MCPVault spawned the server and completed a real MCP handshake, confirming it starts and responds correctly. Read the repository README and recent issues to gauge maintainer responsiveness. Avoid servers with no commits in the last year, missing licenses, or unresolved security disclosures. For local servers, run them in a sandbox or container and review the code before granting filesystem access. MCP servers run executable code, so treat unverified sources with the same caution you would apply to any command-line tool.