MCP 伺服器日益普及，應像 API 一樣管理
"🔌 MCP Servers Are Spreading. Treat Them Like APIs"
MCP 伺服器日益普及，文章主張應像管理 API 一樣管理它們，在接入前控制權限與影響範圍。建議固定 commit 或 release tag、限制檔案及網絡存取、審核工具白名單、避免模型接觸原始密鑰，並遮蓋參數記錄每次工具呼叫。資金轉移、生產環境部署和密鑰輪換應留在自家適配器；社羣伺服器則可先在使用假憑證並記錄白名單的預備環境主機測試。
MCP crossed from “interesting RFC” into “paste this server into your agent.”
GitHub READMEs, Discord drops, and one-click installs now ship tools that can read files, hit HTTP, and sometimes run shell. That is power. It is also the same surface that ate API keys in every other plugin ecosystem.
What is actually shipping
A Model Context Protocol server exposes tools and resources to a host (Claude Code, IDE agents, custom runtimes). The host decides which servers attach. The model decides which tools to call. Your job is everything between those two sentences: allowlists, auth, and blast radius.
Community servers move fast. Pin a commit or a release tag. “Latest” is how supply-chain surprises arrive.
Minimum hardening before attach
- Run the server as a separate process with the least filesystem and network it needs.
-
Allowlist tools — if the server offers
run_shell, leave it off until you have a reason. - Inject secrets at the edge — the model should not see raw keys; the host or a proxy injects them into approved calls.
- Log every tool call with args redacted. You will need the trail.
// sketch: only expose a subset of tools from an MCP server
const allow = new Set(["search_docs", "get_issue"]);
for (const tool of server.listTools()) {
if (!allow.has(tool.name)) continue;
host.registerTool(wrapWithAudit(tool));
}
MCP vs a custom tool adapter
| MCP server | In-repo tool adapter | |
|---|---|---|
| Speed to try | Fast | Slower |
| Versioning | External | Yours |
| Review | Often thin | PR-reviewed |
| Fit when | Shared protocol across hosts | Critical side effects |
Use MCP to explore and to standardize. Keep money movement, production deploys, and secret rotation in first-party adapters until the server has the same review bar as your services.
Honest trade-off
Blocking community servers slows experimentation. Opening them without a sandbox is how you buy someone else’s bug. The middle path is a staging host with fake credentials and a recorded allowlist, then promote servers the same way you promote libraries.
Practical checklist
- [ ] Pinned version / commit
- [ ] Network egress limited
- [ ] Tool allowlist reviewed in a PR
- [ ] Secrets never in model context
- [ ] Audit log on every invocation
Which MCP servers in your stack could delete data today if the model asked nicely?
來源：DEV Community · dev.to