Four risks matter: the credential you hand the server can usually do far more than the one task, tool results are untrusted text that can carry instructions the model may follow, a community server is code from a stranger running on your machine, and an agent that can send or write can do it at machine speed before anybody notices.
An MCP server does what your credential allows, not what the tool description says. A CRM key scoped to full access does not become read only because the agent was only asked to read. Scope the credential at the vendor, not in the prompt. Of the 165 servers counted here, the OAuth ones are the better shape for this: the token is scoped and revocable from the vendor side without touching the agent's config.
An agent reads what a tool returns. A scraped page, an inbound email, a CRM note or a form submission can contain text written by someone who wants your agent to do something. If that text reaches the model and the model can call tools, the instruction can be acted on. This is the single most GTM specific risk on this list, because the entire job involves ingesting text strangers wrote. Keep destructive tools behind human approval and do not let a research step and a send step share an unsupervised loop.
21 entries here have a community server, and a locally installed server runs with your user's permissions. Read who published it, whether the vendor acknowledges it, and what it wants access to. The repo health rail that would date stamp each one has not been run for this build, so this directory publishes no staleness claim at all rather than a stale one.
Every failure above already existed with scripts. What is new is that nobody wrote the sequence in advance. 45 entries here are tagged run an email sequence and 28 are tagged write crm records. Those two capabilities in one unsupervised loop is how a bad enrichment result becomes two thousand wrong emails and a polluted CRM in the same afternoon.
Every number on this page is generated from directory.json at build time and carries the date it was baked: 2026-08-25. Nothing is typed by hand, nothing is rounded, and nothing is estimated. The underlying data is published in full. Where the honest answer is a zero, the zero is printed.