Short answer
Skills and MCP servers inherit the permissions of the host agent and client configuration around them. If the client can read files, run shell commands, call the network, or access OAuth-backed services, the tool layer can often reach those capabilities too.
The real question is not “does it have permissions in theory?” but “what exact host, config, scope, and approval model is wrapped around it?”
What actually defines the blast radius
- The host client: Claude Code, Codex, Cursor, VS Code, and Windsurf do not expose the same approval and sandbox models.
- The transport: local stdio servers usually run closer to your machine than remote read-only HTTP endpoints.
- The server design: a “read-only” brand label is only as good as the server implementation behind it.
- Your configuration: user-level installs, environment variables, and auto-run settings materially change risk.
Files, network, and shell are the three categories to inspect first
File access: a tool can often read project files, generated outputs, local caches, and sometimes secrets accidentally committed nearby. If write access exists, it can also change source, tests, configs, and generated artifacts.
Network access: even a seemingly simple helper may call external APIs, download dependencies, or exfiltrate context. This matters both for privacy and for supply-chain exposure.
Shell execution: once a server or agent flow can spawn processes, it can install packages, alter the environment, launch background jobs, or chain into other binaries on your machine.
Some hosts add guardrails, but do not assume they save you
VS Code now documents optional MCP sandboxing for local stdio servers on macOS and Linux, and Cursor, Claude Code, and Windsurf all surface different approval patterns for tool use. Those are useful controls, but they are not a substitute for trusting the server itself.
Aescut treats permissions as first-class review data because the host UI alone is not a security guarantee.
Sources and further reading
Related questions
Security And Trust
Are skills safe to install?
Why the answer is “sometimes”, and what separates a safe install from a reckless one.
Security And Trust
What should I check before installing a skill?
A practical pre-install checklist for skills and MCP servers.
Security And Trust
What do the risk levels mean?
How to interpret Aescut’s risk levels, trusted maintainers, and stale reviews without oversimplifying them.