# Before installing an MCP server: review the package, process and connected account separately

Source: https://www.web3sec.news/blog/mcp-server-installation-review
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Verify package identity, version, entry point and update behavior.
- [ ] Review installation hooks before running a launcher.
- [ ] Constrain local filesystem, environment, processes and network.
- [ ] Inspect remote scopes, account binding and revocation.
- [ ] Test denied reads/writes and independently verify removal.

## References
- [MCP: server concepts, tools, resources and prompts](https://modelcontextprotocol.io/docs/learn/server-concepts)
- [MCP: security best practices, 2025-11-25 specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices)