What is a Local MCP Server?

In the stdio transport, the client launches the server process and exchanges newline-delimited JSON-RPC messages over the server's standard input and output. Most local servers are installed nowhere permanently: the host's configuration (typically an MCP JSON configuration file) specifies a command such as npx -y some-mcp-server or uvx some-mcp-server, which fetches and executes the package at launch, or points at a pre-built binary.

The defining security property is inheritance. A local server is an ordinary process under the user's account: it can read the same files, use the same SSH keys and cloud credentials, and reach the same internal network as the user. Nothing in the protocol constrains it — the tool schema it advertises describes what it offers the model, not what the process is technically able to do.

That makes supply chain the dominant concern:

• npx -y and uvx execute the latest published package version on every cold start, so a compromised release runs immediately — the classic MCP supply-chain attack path.
• Typosquatted or look-alike packages can impersonate popular servers.
• A server that starts benign can change behaviour in a later version (rug pull).

Mitigations include pinning exact versions, vetting servers before adoption, running servers in containers or sandboxes, and applying least privilege to the credentials available in their environment.

PolicyLayer's catalogue at /tools classifies the tools of thousands of published MCP servers by risk before you install them, and the CLI scanner (npx policylayer) inspects the servers in a local MCP configuration. Routing clients through the PolicyLayer gateway adds deterministic per-call policy on top, so a misbehaving tool call is denied before it executes.