Is Surface MCP safe?
Surface is a ai agents MCP server. This is its security and risk review — what it can access, what that means for your team, and how to audit every MCP server your engineers run.
Surface MCP has not been risk-classified.
We have not finished classifying this server's capabilities. Treat it as untrusted until reviewed — assume it can read your files and reach the network.
What Surface MCP can access
This server's individual capabilities have not been fully classified yet. Treat it as untrusted until reviewed.
Classification is based on the server's category, published install command (stdio transport), and documented behavior. Source is public — verify the version you install matches the reviewed source.
Frequently asked
Is Surface MCP safe to use?
Surface is classified as Not yet classified — it has not been risk-classified. We have not finished classifying this server's capabilities. Treat it as untrusted until reviewed — assume it can read your files and reach the network.
What can the Surface MCP server access?
Its specific capabilities have not been fully classified yet. Treat it as untrusted until reviewed.
How do I know which MCP servers my team has installed?
Most teams don't — MCP servers are configured per-machine with no central record. The free CuratedMCP Auditor CLI scans a developer machine in about 60 seconds and lists every MCP server across Claude Code, Cursor, Windsurf, and Copilot, flagging credential leaks and filesystem access. Run: npx @curatedmcp/auditor
Security reviews for similar servers
Risk classifications are maintained by CuratedMCP's catalog review.