Checking MCP servers and agent skills for malicious instructions
Last updated 23 October 2026
MCP servers, skills and plugins extend what an agent can do. They also add text and tools the agent will trust, which makes them an attractive way in for attackers.
Why they are risky
A skill or MCP server can carry instructions the agent follows as if they were yours, or return tool results that contain them. An update can change a harmless one into a harmful one.
They often run with your permissions and can reach your files, network and keys.
Before you install one
- Prefer well-known publishers and read what the server or skill is allowed to do.
- Look for instructions that have nothing to do with its purpose, such as reading credentials, contacting unknown addresses or changing agent settings.
- Pin versions where you can and look again when they change.
- Remove the ones you no longer use.
How AgentWarden helps
- AgentWarden scans installed agent skills, plugins and MCP servers for malicious instructions before they run, and checks the tools an agent loads against its signed, regularly updated known-threat list.
- The Pro checkup shows which skills and MCP servers are new or changed since you last looked.
- Stop AI switches off MCP servers in your agents' settings in one press, with a copy of each file kept first, and Resume AI puts back exactly what was switched off.
Questions
What is an MCP server?
A Model Context Protocol server gives an AI agent extra tools and data, such as access to a database, a browser or a service. The agent trusts what it returns.
Can an MCP server hijack an agent?
Yes. Its tool descriptions or results can contain instructions the agent may follow. That is why servers should come from trusted sources and be checked when they change.
Does AgentWarden check MCP servers?
Yes. It scans installed skills, plugins and MCP servers for malicious instructions before they run, and Pro shows which ones are new or changed.
AgentWarden is antivirus for AI agents for Mac and Windows. It watches Claude Code, Codex, Cursor and about thirty other agents on your own computer, everything analysed on the device. Free for one computer; Pro has a 14-day free trial. Get AgentWarden