Why You Should Audit Regularly
You probably connected a bunch of MCP servers over the past few months. Some you use daily. Some you tried once and forgot about. The problem is that forgotten connections still have active credentials and permissions. They're attack surface you're not getting any value from, and that's the worst kind of risk.
A quick audit every month or two doesn't take long, and it consistently turns up connections you can safely remove. Think of it like clearing out browser extensions you don't use anymore. Each one is a potential vulnerability sitting idle.
Step 1: List Everything That's Connected
Start by pulling up your MCP configuration file. In Claude Desktop, that's usually claude_desktop_config.json. In Cursor, check your settings. Make a list of every server that's configured. For each one, note what it connects to (a database, an API, a file system) and what credentials it uses.
You'll probably find a few surprises. Maybe a server you configured for a project that's already finished, or a test server that's pointing at a production database. These are the ones that need attention first.
Step 2: Review Permissions and Scope
For each active connection, ask: does this server have the minimum permissions it needs? A database MCP server that only needs to read data shouldn't have write access. An API server that only needs one endpoint shouldn't have a token with full account access. Overly broad permissions are the most common security gap in MCP setups.
Check the security grades on Skillful.sh for servers you're using. If a server you rely on has a low security score, dig into why. It might be fine for your use case, or it might be worth swapping for a better-reviewed alternative.
Step 3: Rotate Credentials and Remove Dead Connections
If a connection has been active for months with the same API key or token, rotate it. Most services make this easy. Generate a new key, update your MCP config, and revoke the old one. This limits the damage if any credential was leaked without your knowledge.
For connections you don't use anymore, remove them entirely. Delete the server from your config, and revoke whatever credentials it was using. Don't just disable it, because disabled configurations with live credentials are still a liability.
Making It a Habit
The easiest way to stay on top of this is to set a recurring reminder. Once a month, spend 15 minutes reviewing your connections. It's the kind of thing that feels tedious until the one time it catches something important. Building responsible production habits starts with small routines like this.
Related Reading
- How to Evaluate an MCP Server Before Installing It
- Why Security Scoring Matters for AI Tools
- Monitoring MCP Server Health in Production
- The Real Cost of Not Updating Your MCP Servers
Browse MCP servers on Skillful.sh. Search 137,000+ AI tools.