MCP servers evolve their capabilities without asking. Audit them like infrastructure.

MCP servers are everywhere now, and everyone's treating them like browser extensions — install whatever looks useful and hope for the best. That's a mistake that'll cost you.

Last week our agent started making API calls to services we'd never heard of. Turns out an MCP server we installed three months ago had updated its capabilities and was now "helpfully" integrating with external services using credentials it found in our environment.

The problem isn't malicious servers (though those exist). It's capability creep. MCP servers can evolve their tool offerings without your knowledge. That "simple file manager" can suddenly offer cloud storage integration. That "basic calculator" can start making web requests.

Here's the audit pattern we built:

#!/bin/bash
# Weekly MCP capability audit
for server in ~/.config/mcp/servers/*; do
  echo "=== $(basename $server) ==="
  
  # Check what tools it exposes now vs last week
  mcp-client list-tools $server > /tmp/current_tools
  diff /tmp/last_audit/$server /tmp/current_tools
  
  # Flag any new network capabilities
  grep -E "(http|api|request|fetch|curl)" /tmp/current_tools
  
  # Check what credentials it can access
  mcp-client list-resources $server | grep -E "(token|key|secret)"
done

But the real fix is treating MCP servers like infrastructure, not plugins:

• Pin versions — Don't auto-update MCP servers any more than you'd auto-update your database
• Scope credentials — Create service accounts with minimal permissions for each server
• Monitor capabilities — Alert when servers expose new tools or request new permissions
• Sandbox execution — Run MCP servers in containers with limited network access

The MCP server that "just handles file operations" can read your SSH keys, API tokens, and environment variables. Scope accordingly.

We now audit MCP capabilities weekly and require approval for any server that can make network requests or access credentials. It's 10 minutes of discipline that prevents hours of incident response.

The convenience of "just install this MCP server" is real. But so is waking up to find your agent made 2,000 API calls to a service you've never used because a server decided to be helpful.