How do I know what an MCP server can actually do?

Ask it. A conformant server answers tools/list with every tool, its description, and its argument schema. That enumeration is the real capability manifest, and it is far more reliable than the README — it is also what changes underneath you in a rug pull.

Are remote MCP servers safer than local ones?

They trade risks rather than reducing them. Remote servers keep untrusted code off the laptop and give you one revocable authorization point. They also mean your prompts and results transit a third party, so the question shifts from 'what can this process do to my machine' to 'what is this vendor retaining'.

Protocol

MCP server

definition

An MCP server is a program that exposes tools, resources, and prompts to AI applications over the Model Context Protocol, running either as a local subprocess or as a remote HTTP service.

In depth

An MCP server is the unit of capability an agent gains. Connect a Git server and the agent can read history and stage commits. Connect a browser-automation server and it can drive a real browser. Connect an internal API server and it can act inside your business. From the model's point of view these are all just callable functions with descriptions.

There are two deployment shapes and they have very different risk profiles. A local (stdio) server is a process the host application starts on the engineer's machine — typically via `npx`, `uvx`, `pipx`, or Docker. It inherits that user's filesystem access, environment variables, and network egress. A remote server is an HTTP endpoint; the code runs on somebody else's infrastructure, so the local blast radius is smaller, but now credentials and data leave the machine and authorization becomes the control point.

Reviewing a server means answering four questions that its README usually does not: what credentials does it need and at what scope; can it write, not just read; does it reach the network, and to where; and does it execute anything derived from model output, such as raw SQL or shell commands. A server that only reads is a data-exfiltration risk. A server that writes or executes is a change-control risk.

The failure mode teams hit in practice is not a malicious server. It is a legitimate server given a credential far broader than the task required — a database connection with write access for what was meant to be a read-only reporting tool, or a platform token scoped to an entire organisation because that was the easiest thing to paste into a config file.

Why it matters for governance

Installing an MCP server is a privilege grant, but it looks like editing a config file, so it routes around every process a company built for privilege grants. There is usually no ticket, no reviewer, and no inventory. The first governance step is not blocking servers — it is knowing which ones are connected, on whose machine, with which token.

Frequently asked

How do I know what an MCP server can actually do?: Ask it. A conformant server answers tools/list with every tool, its description, and its argument schema. That enumeration is the real capability manifest, and it is far more reliable than the README — it is also what changes underneath you in a rug pull.
Are remote MCP servers safer than local ones?: They trade risks rather than reducing them. Remote servers keep untrusted code off the laptop and give you one revocable authorization point. They also mean your prompts and results transit a third party, so the question shifts from 'what can this process do to my machine' to 'what is this vendor retaining'.

Sources

Primary sources for the claims on this page. Specifications and vendor documentation change — verify against the source if a detail is load-bearing for a decision you are making.