What does the MCP specification say about safety?

On its tools page it says there should always be a human in the loop with the ability to deny tool invocations, and that clients must treat tool annotations as untrusted unless they come from trusted servers.

What did OX Security find in the MCP SDKs?

OX Security reported on April 15, 2026 that the STDIO transport in Anthropic's official SDKs can execute commands by design when untrusted input reaches its configuration, and estimated up to 200,000 vulnerable instances. That figure is OX's own.

Is a local MCP server safe because it runs on my machine?

No. A local server is a program running as you. Only connect ones you would run as a program, and give the AI the narrowest access you can.

News · Academy · November 14, 2026

Before you connect an MCP server: five checks

MCP lets an AI call tools. The spec says a human should be able to deny each call. Five checks before you connect a server, and one design flaw to know.

DRIVE 369 DAO · 3 min read

MCP (the Model Context Protocol) lets an AI call tools: read files, query a database, send a message. Connecting a server gives the AI new abilities, so it is closer to installing a program than to adding a bookmark. The protocol's own specification says that "there SHOULD always be a human in the loop with the ability to deny tool invocations." Facts below were read on November 14, 2026 from the MCP specification (tools page; the wording quoted here is the same in versions 2025-06-18, 2025-11-25 and 2026-07-28) and from OX Security's research page.

What is proven, reported and claimed

Claim	Source	Tier
A human should be able to deny each tool call, and clients should show tool inputs before calling	MCP specification, tools page	Specified (SHOULD, not enforced)
Clients must treat tool annotations as untrusted unless the server is trusted	MCP specification	Specified (MUST)
Servers must validate inputs, control access, rate limit and sanitize outputs	MCP specification	Specified (MUST)
The STDIO transport in the official SDKs (including Python, TypeScript, Java and Rust) can execute commands by design when untrusted input reaches its configuration	OX Security, April 15, 2026	Reported by a vendor
Up to 200,000 vulnerable instances; 7,000+ public servers	OX Security, own estimate; its research page does not say how it was counted	Claimed
Anthropic declined to change the architecture and called the behaviour expected, leaving sanitisation to developers	OX Security's account of the response	Reported by a vendor

We could not check OX's numbers independently. Treat them as a reason to be careful, not as a measurement.

Five checks

Who runs it, and where? A local STDIO server runs a command on your machine as you. Connect only servers you would be willing to run as a program, from authors you can name.
Read what it can do. List the tools it exposes. Treat their descriptions and annotations as untrusted text; the specification says clients must treat annotations as untrusted unless the server is trusted.
Confirm what cannot be undone. Anything that sends, pays, deletes or publishes should ask you first, with the inputs shown.
Narrow keys, one per client. A separate token with the smallest scope you can set, so one hijacked AI does not open everything.
Log and re-check. Keep a record of tool calls, and look again when a server's tool list changes.

Where Ghostdrive stands

Ghostdrive's Crew gateway listens only on your own machine, gives each connected AI its own token (the vault keeps only a hash), lets you choose scopes, has no scope that sends, pays, signs or publishes, and keeps a per-client log, a rate limit and a stop switch. Claude and private memory shows a second route: the Ghostdrive MCP server, which talks only to your node's local API.

The limit is plain: Crew controls what our gateway exposes. It does not vet other MCP servers you connect elsewhere, and a connected AI can still be wrong or be misled by a page it reads, which is why steps wait for you (prompt injection). It runs on a testnet-stage product.

Academy: start here · Ten guardrails for agents · What the 2026 safety report says

Questions

What does the MCP specification say about safety?: On its tools page it says there should always be a human in the loop with the ability to deny tool invocations, and that clients must treat tool annotations as untrusted unless they come from trusted servers.
What did OX Security find in the MCP SDKs?: OX Security reported on April 15, 2026 that the STDIO transport in Anthropic's official SDKs can execute commands by design when untrusted input reaches its configuration, and estimated up to 200,000 vulnerable instances. That figure is OX's own.
Is a local MCP server safe because it runs on my machine?: No. A local server is a program running as you. Only connect ones you would run as a program, and give the AI the narrowest access you can.