Is this MCP server safe to install?

The README tells you what a server is for. A review needs to establish what it can do, which is a different question, and four answers cover most of it.

What credentials does it need, and at what scope? This is the single most predictive signal. Over-permissioned credentials — an organisation-wide platform token, a live production key, a database role that bypasses row-level security — turn every other risk into a serious one. Most real incidents are a legitimate server holding a credential far broader than the task required.

Can it write, or only read? Read access is an exfiltration risk: whatever it reads enters the context window and travels wherever that session travels. Write access is a change-control risk, and where the write target is a build script, a git hook or a CI configuration it is also a persistence mechanism that outlives the session.

Does it reach the network, and where to? Egress is the exit in almost every agent attack chain. A server that both ingests untrusted content and can reach arbitrary hosts is the whole vulnerability in one connection.

Does it ingest attacker-writable text? Issue bodies, page content, application rows, error messages and customer-supplied fields are all outside your trust boundary and all read by the model as apparent instruction. A server whose purpose is to fetch or query is an injection entry point by design, not by accident.

Then enumerate the tools. A conformant server answers a tool-list request with every tool name, description and argument schema — and that enumeration, not the README, is the real capability manifest. It is also what silently changes underneath you, which is why capturing it at approval time and comparing it later is the control that catches a rug pull.