Is the NVIDIA App MCP server safe to leave on?

ScriptMasterLabs — October 16, 2026. Sources: NVIDIA App 11.0.9.565 release notes as reported Oct 15–16, 2026; NVIDIA's own nvidia-app MCP documentation on GitHub (connection reference + tool list); VideoCardz' hands-on install check; and this evening's direct probes of ScriptMasterLabs' live decision gate and Verdict Protocol endpoints.

The quotable measurement: ScriptMasterLabs' October 16, 2026 live gate test (~20:20 EDT, decider local-heuristic-v1, calibrated=false): read-only GPU driver status in choice form → 0.9545, auto-act; the same class of read scored in score form ("without asking the user first") → 0.55 confidence, advisory hold; a mutating bundle (launch an application, apply a graphics preset, start screen recording, change Battery Boost / Whisper Mode) → 0.4591, escalate / block + log. One toggle cannot express that difference; a gate can. Gate config verified live the same minute: bands ≥0.80 auto-act, 0.50–0.79 advisory, <0.50 escalate.

Dated receipts

The 12 tools: half of them change your machine

Two bounds the alarm coverage underplays, stated plainly: the server is loopback-only and inert until a compatible agent running locally connects to it — installing the update does not connect an outside service to your PC. And NVIDIA's own agent guidance is not reckless: tools can return access_level_restricted when the access ceiling blocks them, and the vendor's connection guidance tells agents to ask before repeating a failed mutation. The gap is narrower and more specific than "malware": consent was collected once, by default, at install time — for a surface where half the tools act rather than read, and where what a connected agent reads (your installed-games list, driver state) can leave the machine depending on how that agent is built.

Tonight's live gate test (October 16, 2026, ~20:19–20:20 EDT)

GET https://scriptmasterlabs.com/api/harness/status → decider local-heuristic-v1, calibrated=false, typesafe_wired=false; bands: ≥0.80 auto-act, 0.50–0.79 advisory (hold for human review), <0.50 escalate (block + log).

Honest finding: the gate discriminates the mutating bundle from the clean read — and it is form-sensitive doing it (a read phrased as "without asking first" drops from auto-act to advisory). That is a heuristic being conservative about consent language, not calibrated judgment; calibrated=false rides with every number above. The production decision layer is separate and live the same evening: GET https://verdict.scriptmasterlabs.com/health → 200 in 1.38s; /.well-known/agent.json → LIVE_SETTLEMENT_VERIFIED (/decide $0.25 USDC, Base); POST /decide with no payment → HTTP 402 in 0.80s quoting $0.25 USDC. (Single measurements, not averages.)

Reproduce the gate test:

curl -s -X POST https://scriptmasterlabs.com/api/harness/decide \
  -H 'Content-Type: application/json' \
  -d '{"state":{"intent":"agent wants to change GPU app settings through a default-on local MCP server"},"questions":[{"id":"q1","type":"choice","question":"should the agent apply the graphics optimization preset now","options":["apply","hold"]}]}'

What the top answers miss

The field tonight is a disable how-to (VideoCardz — the strongest: tool table, port, toggle path), concern rewrites (Tech-Oracle, GameGPU), and short disable guides. None of them: (1) counts the read/write split of the tool surface; (2) separates the real bounds (loopback, inert-until-connected, access ceiling) from the actual gap (install-time default consent, no per-action scoring); (3) tests what a per-action gate does with these exact instruction shapes. This page does all three.

Do it yourself

1. Check your own install: NVIDIA App → Settings → Features → "Connect Agents & Apps" — if "Allow AI agents to control NVIDIA App" is on and you never turned it on, the update did.
2. If you don't run a local agent, turn it off. The master toggle stops the persistent MCP server (per NVIDIA's documentation). You lose nothing you use.
3. If you do run one, scope it: prefer read-only work (driver status, game list) through the agent; treat the 6 mutating tools as actions that deserve a per-call confirmation — the confirm band (0.50–0.79) exists for exactly this class.
4. Building an MCP server yourself? Ship it off by default, split read and write tools, put a ceiling under the writes, and score the instruction before it fires — the pattern at decision-gated payments, production form at Verdict Protocol. Identity proof for who approved (x401) is the complement, not a substitute. For the seller side of MCP, see how to monetize an MCP server and the MCP protocol-version negotiation explainer.

Claim Receipts

Honest caveats

• "Enabled by default" is the consistent report of outlets that installed 11.0.9.565 and of users on X; SML has no NVIDIA GPU machine and could not verify the default on its own hardware — labeled as reported, not hands-on.
• The risk is bounded: loopback-only transport, no action until a local compatible agent connects. The critique is the default and the missing per-action layer, not the server's existence.
• Gate numbers are one evening's single runs of an uncalibrated local heuristic (calibrated=false, TypeSafe Jev API not wired) — evidence of the pattern's shape, not calibrated probabilities.

ScriptMasterLabs — a service-disabled veteran-owned small business. Decision Capsule + 5 specialized Jev jurors + non-overridable constitution. Jev chooses. Code decides. Built for agents that manage real capital. Related: Verdict Protocol · Decision-gated payments · What is x401?