Is MCP safe? MCP security, explained

By the Goliath research team · Checked November 12, 2026

MCP security depends on the server you connect and the access you give it. The protocol has solid rules for sign-in and permissions.

The real risks

1. Prompt injection

An AI follows plain-language instructions. It can't always tell yours from text it reads along the way.

2. Tool poisoning

An MCP server describes its tools to the AI in text. You usually don't see that text, but the AI reads it.

3. Over-broad access

A server that can do everything does more damage. Then a mistake or injected instruction can send a text, delete a contact or spend a credit.

4. Pasted keys and unknown community servers

Many open-source MCP servers ask you to paste an API key into a settings file. That key often has full account access, never expires and sits on your computer in plain text.

OAuth vs. API keys

The MCP standard sets sign-in for web servers: OAuth 2.1, the system behind "Sign in with Google".

You sign in on the company's own page, in your browser.
The AI app gets a token, not your password. Tokens are meant to be short-lived, and you can revoke them.
The token only works for that one server. Servers must check a token was issued for them, and can't pass it to another service.
Sign-in uses PKCE, which stops someone who intercepts the sign-in from using it.

Prefer OAuth sign-in over a pasted key.

Read-only vs. write access

The most useful control separates looking things up from making changes.

Read-only access lets the AI search, count and summarize.
Write access lets it create, update, send and delete.

A sensible default: let look-ups run, approve every write.

How Goliath handles it

Goliath's real estate MCP was built around the checklist below:

OAuth 2.1 sign-in. You connect from Claude or ChatGPT and sign in to Goliath in your browser.
It acts as you. The AI uses your own Goliath permissions.
You choose the level at sign-in. "Look things up", or a level that can make changes.
Reads and writes are separate tools. Your AI app can let look-ups run and ask before every change.
Sending is off until an admin turns it on. An admin in your account must enable sending before an AI app can text or email.
Spending is visible. Owner lookups use your plan's export credits, the same as in the app.

Checklist

The server is run by a company you'd trust with this data anyway, not a stranger's GitHub project
You sign in with OAuth, not a pasted key
You've read the tool list
It acts with your permissions, not admin-for-everything
Look-ups and changes are separate, and you started with look-ups only
Your AI app asks before any write
Sending and spending (texts, emails, payments, data credits) need a deliberate switch
You can revoke it from the app and from the server

Questions

Is MCP safe for business data? Yes, with a trusted server, OAuth sign-in, your own permissions and approval on writes.

Can an MCP server see my other data? Only what it's given, but its tool descriptions can steer your AI's other servers.

Is a remote MCP server safer than one I run on my computer? In some ways, yes: it can't read files or run programs on your computer.

realestatemcp.org is built by Goliath. Last checked November 11, 2026.