Is Runheed MCP safe?
Runheed is a developer tools MCP server. This is its security and risk review — what it can access, what that means for your team, and how to audit every MCP server your engineers run.
Runheed MCP has not been risk-classified.
We have not finished classifying this server's capabilities. Treat it as untrusted until reviewed — assume it can read your files and reach the network.
What Runheed MCP may access
Not reviewed yet. This list comes from the listing as submitted. No one at CuratedMCP has checked it against the code, so it may include things the server doesn't do, or miss things it does.
Fetches web content
Makes outbound HTTP requests to external URLs.
Executes shell commands
Can run commands or spawn processes on the host machine.
Risk level and capabilities are provisional until a review. Source is public, so check that the version you install matches it.
Maintain Runheed? Get it reviewed so this page shows what it actually does.
Frequently asked
Is Runheed MCP safe to use?
Runheed is classified as Not yet classified — it has not been risk-classified. We have not finished classifying this server's capabilities. Treat it as untrusted until reviewed — assume it can read your files and reach the network.
What can the Runheed MCP server access?
Its listing says it may have these capabilities, which CuratedMCP has not yet checked: fetches web content, executes shell commands.
How do I know which MCP servers my team has installed?
Most teams don't — MCP servers are configured per-machine with no central record. The free CuratedMCP Auditor CLI scans a developer machine in about 60 seconds and lists every MCP server across Claude Code, Cursor, Windsurf, and Copilot, flagging credential leaks and filesystem access. Run: npx @curatedmcp/auditor
Security reviews for similar servers
Risk classifications are maintained by CuratedMCP's catalog review.