Watchman / Guides

MCP security for Claude Code and Cursor

MCP tools can read your files and run commands. Most people never check what they connected.

By Chris Taylor, Taylor Family Software. Updated October 30, 2026.

The Model Context Protocol lets an AI app talk to tools: your files, GitHub, a database, a browser. Each MCP server is a program running with your permissions. Your AI decides when to call it. That's the whole risk in one sentence.

Where the configs live on a Mac

Open them. Read every server listed. If you don't remember adding one, find out why it's there.

The three settings that get people hurt

1. Whole-home access

A filesystem server pointed at ~ or / can read your SSH keys, your browser data and every document you own. Point it at the one project folder you're working in.

2. Auto-updating tools

A server launched with npx some-package@latest or uvx without a version can pull a newer version on launch. If that package is hijacked, you can end up running the attacker's code. Pin an exact version.

3. No-ask mode

Claude Code's --dangerously-skip-permissions flag, broad allow rules in settings.json, and auto-run modes in Cursor all let the agent run commands without asking you. Combine that with one prompt injection and the agent does whatever the file told it to.

Claude Code security checklist

• Keep permission prompts on. Allow specific commands, not wildcards.
• Don't run agents in your home folder. Open them in a project folder.
• Pin every MCP server version.
• Move API keys out of env blocks in config files and into the Keychain where you can.
• Remove servers you don't use. Fewer tools, fewer doors.
• Treat repos, issues and web pages from strangers as untrusted input.

Check it in one click

Watchman's Agent Leash reads the Claude Code, Claude Desktop and Cursor configs on your Mac and flags whole-home access, auto-updating tools, plain-text keys and no-ask settings. Each finding comes with the exact fix. Nothing leaves your Mac.

Questions

Are MCP servers safe?

An MCP server is as safe as the code it runs and the access you give it. Use servers from sources you trust, pin their versions and limit their folders.

Does Claude Code send my files to Anthropic?

Claude Code sends the files and output it reads to the model to do its work. That's why limiting what it can read matters.

What does --dangerously-skip-permissions do?

It lets Claude Code run tools and commands without asking you first. Only use it inside a throwaway container or VM.