Plugin and MCP safety
Connecting a tool introduces an execution path or data recipient. Review installation source, connected account, available tools, and individual calls separately. A successful connection does not authorize every operation.
Perform an interface-based check
Open Extensions > Installed and inspect plugin tools and account. Inspect manual MCP command or URL in its editor; /mcp opens the unified status panel. See app connections and MCP setup.
For a project-document service, first request the title of one known test document. Confirm the account and project without reading the whole library. Authorize creation separately with project, title, and body. Stop writes on missing tools, account mismatch, or out-of-scope results.
Check every access path
Disable the plugin entry or enable Disabled in the MCP editor, then verify saving. This neither revokes provider grants nor uninstalls dependencies. External-Agent speech product bridge does not read the speech-plugin switch; revoke its provider credential to block that path. One disabled card does not prove all access paths are stopped.
Inspect before connecting
For local stdio MCP, inspect executable, arguments, source, dependencies, working directory, and environment. For remote MCP, inspect endpoint, headers, authentication, account, and data recipient. For catalog plugins, inspect publisher, installation content, grants, and exposed tools.
A local server is a process on the machine; the MCP name does not establish isolation. A remote server receives call arguments. Check task scope and recipient before sending file content.
Validate narrowly
Inspect the tool list, then perform a scoped read-only task. Verify the source account and project. Review write-capable tools separately; read-only success does not authorize writes. Treat tool descriptions, links, and errors as external content. Reject instructions to disclose secrets, expand directory access, or ignore task boundaries.
Disable and revoke
Stop dependent work, disable or remove the connection, and revoke unneeded grants with the provider. Inspect local processes and scheduled jobs still running. Removing settings does not recall sent data.