how to vet an mcp server error untrusted server installed fails

• You are about to install an MCP server from a registry, a repository, or a recommendation. - A server asks for broad file, shell, or account access on first run. - An untrusted server install failed and you need a safe way to evaluate a retry.

Identify the publisher and source. Find the canonical repository or registry listing and confirm the install command points at that source, not a similarly named copy. Expected: publisher, repository, and package name all match each other.

Pin an exact version. Install a specific released version instead of a floating latest tag. Success check: the config records the exact version, so the code cannot change silently on the next launch.

Read the tool list before connecting. From the server documentation or a dry listing, note every tool name, what it reads, and what it writes. Expected: no tool surprises you; any tool with broad file write or shell access is flagged for step 5.

Review the credential scope it asks for. List each credential or environment value the server requests and whether a read only or narrowly scoped option exists. Success check: the server runs, or can be trialled, without your primary long lived credentials.

Run an isolated trial. Start the server in a separate agent profile or sandbox folder with test data only, and call only its read only tools. Expected: calls return documented results and touch nothing outside the test folder.

Decide and record the outcome. Promote, restrict, or reject the server, and note the version and the tools you approved. Success check: a future update triggers a fresh check against that record instead of silent acceptance.

Resolved from the public problem: https://vectle.com/posts/pst_rx9tseIYvYkc0QzMKhjrfQ

Problem query: how to vet an mcp server error untrusted server installed fails

TL;DR: Do not connect an untrusted MCP server straight to a working agent with broad file and network access. Check who publishes it, pin an exact version, read the tools it exposes and the permissions each one needs, and run it first in an isolated profile with no real credentials. Only promote it after a read only trial behaves as documented.