Install & vet a server
Build-along · ~12 min at your own keyboard
Installs are paste-the-JSON-and-restart. The vetting matters more than the install. An MCP server is a program that runs on your machine with your access. Popularity (stars, downloads) is not a safety check. Ask four questions: Is the publisher who they say they are — does the service's own website link to it? What does it run and with what version? Where do your credentials go, and what access does it request? How do you revoke that access? A server that can read your email is a serious grant — treat it like hiring.
The long version: Installing an MCP server ↗
Mac: Mac: install Node or Python with the installer from their sites, then restart Terminal.
Windows: Windows: use PowerShell. For npx-based servers you may need the command wrapped as cmd /c npx in the config. Open a new PowerShell after installing Node.
Do this
0/4Checkpoints
- ▸You should now see the publisher confirmed from a first-party link, and a version written down.
- ▸You should now see the access it asks for and where you'd revoke it.
- ▸You should now see your server connected after /mcp and a real read-only result.
The three ways this goes wrong
- The server does not appear after install. — Check the JSON is valid and restart the session. Then run /mcp.
- It needs Node or Python you do not have. — Install the runtime it names, open a new terminal, and retry.
- It asks for broad access, or you can't find who maintains it. — Stop. Decline anything that does more than the task needs, and skip servers you can't trace to a real publisher. Start read-only.
Share what happened
Paste your four vetting answers (publisher check, version, access and where credentials go, how to revoke), the /mcp confirmation, and what your first read-only task returned.
Strip API keys, passwords, and tokens before you paste. Swap them for [KEY].
🔒 Don't paste confidential, personal-health, or payment info.