Is this MCP server safe to install?
An MCP server is not a library you call. It is a process your agent talks to, and it inherits the reach you have given that agent: your filesystem, your tokens, whatever tools are connected. The blast radius is larger than a normal dependency, and the install instructions are usually one line someone pasted in a thread.
The specific things worth checking are the ones that would let a server do something other than its stated job. Does it execute code it has decoded rather than code you can read? Does it read credential files or reach a cloud metadata endpoint? Does it contact hosts unrelated to its purpose? Does anything run on install, before you have used it once? Are the dependencies from the registry, or from a git URL that can change under you?
Read the instruction files as well. Agent tooling ships prose the model treats as direction, and a line in there is not code and will not be caught by reading code.
None of this requires running the server, which is fortunate, because running it is the decision you are trying to make. Paste the public repo below and xlogs will read it without installing it.
Check an MCP server's repo before you install it
Common questions
Why is an MCP server riskier than a normal npm package?
Because of what it is connected to. A normal package runs inside your program. An MCP server is wired into an agent that may already have access to your files, your repositories and your credentials, so a malicious one does not need to escape a sandbox - it has been handed the keys.
Does xlogs run the server to test it?
No. It downloads the public repository and reads it. It never installs, never executes and never starts the server. That is a deliberate limit, not a shortcut: a scanner that runs untrusted code to decide whether the code is safe has the problem backwards.