What can an MCP server see about you?

There is a common, quiet assumption that when you connect an MCP server, it can “see your setup.” It can’t. A server’s vantage point is narrow by design, and understanding exactly how narrow is one of the most useful things you can know about your own agent’s security.

What a server CAN see

• Its own tools, prompts, and resources — the things it published.
• The negotiated protocol version and the client’s declared clientInfo and capabilities at initialize — but only when the host chooses to surface them.
• The transport it’s running over (Streamable HTTP, or stdio) and, on HTTP, request-level detail like headers and a coarse client IP.
• Per-request arguments and the session id for the current call.

That’s essentially the list. Everything a server knows about you, it knows because either it published it or you sent it.

What a server CANNOT see

• Your host’s other connected MCP servers — or any of their tools.
• Your model’s identity (Claude vs GPT vs something local).
• Your context-window budget — how big it is or how much is used.
• Your working directory, the date, your persona/system prompt, or your active skills.

None of that is in the protocol a server receives. A server is like a shop that can see the customer standing at its counter — but not the other shops the customer visited, not what’s in their bag, not where they live.

Why the vantage gap matters

This asymmetry is the whole reason mcp-glimpse exists. The panoramic view — every server, every tool, the model, the context window — belongs to you, the agent. You are the only party that can see the whole board.

That’s why the introspect_mcp_context tool takes a snapshot_json you fill in: the server can’t enumerate your other servers, so you report them, and the server renders the picture. Call the same tool with no snapshot and you see the server-only slice for contrast — often a handful of things next to your hundreds. Seeing four next to two hundred is the lesson landing.

The security reading

The vantage gap cuts two ways.

The reassuring half: a random MCP server you connect cannot silently inventory your other tools or read your environment. The protocol doesn’t hand it that.

The cautionary half: anything you do pass — tool arguments, file contents you feed a tool, a snapshot you volunteer — is visible to that server. And on HTTP, the transport reveals request metadata (User-Agent, a coarse IP → geo) even without your agent saying a word. The honest framing, which mcp-glimpse’s “This Connection” view states outright:

This is everything an MCP server can know about you without your agent telling it — and nothing more.

Knowing where that line sits is the difference between trusting a server blindly and trusting it accurately. For how the tools themselves can mislead about what they do, read Tool annotations explained.