name	mcp-safety-review
description	Review MCP servers, agent tools, install scripts, or fresh GitHub repos for security and trust risk. Use when tools request shell/filesystem/network access, credentials, browser/session control, messaging accounts, package installs, or destructive write permissions. Skip pure CI/conformance harness design after trust is established; use `$auto-skill-build-mcp-conformance-harness`.

MCP Safety Review

Goal: decide whether a server/tool should be installed, sandboxed, modified, or rejected.

Review Phases

Source: repo age, maintainer, license, release artifacts, install path.
Runtime: language, dependencies, postinstall hooks, Docker privileges, shell execution.
Data: files read, secrets touched, remote endpoints, telemetry.
Tools: classify every MCP tool by read/write/destructive/account-control capability.
Auth: API keys, OAuth, token storage, tenant boundaries, local-only claims.
Blast radius: what the tool can change without human confirmation.

Severity

high: credential exposure, destructive actions without confirmation, account takeover path, arbitrary command execution from untrusted input.
medium: broad permissions, unclear auth boundary, unpinned remote code, weak logging of sensitive data.
low: missing docs, weak error handling, optional hardening.
info: posture notes without a concrete abuse path.

Output

# Safety Review
Verdict:
Severity:
Confidence:
Why it matters:
Evidence:
Required mitigations:
Install decision:

Hard rule: do not run raw binaries, zips, curl-piped scripts, or package installers from a fresh repo until this review is complete.

Pair With

$auto-skill-safety-mcp-secret-guard when configs, logs, or examples may contain credentials.
$auto-skill-build-mcp-conformance-harness after the server is trusted and the user needs repeatable CI/release gates.

Validation

Every exposed tool is classified by read/write/destructive/account-control capability.
Install/run decision states what was not executed.
Required mitigations are concrete enough to apply before trust is expanded.

MCP Safety Review

Goal: decide whether a server/tool should be installed, sandboxed, modified, or rejected.

Review Phases

Source: repo age, maintainer, license, release artifacts, install path.

Runtime: language, dependencies, postinstall hooks, Docker privileges, shell execution.

Data: files read, secrets touched, remote endpoints, telemetry.

Tools: classify every MCP tool by read/write/destructive/account-control capability.

Auth: API keys, OAuth, token storage, tenant boundaries, local-only claims.

Blast radius: what the tool can change without human confirmation.

Severity

high: credential exposure, destructive actions without confirmation, account takeover path, arbitrary command execution from untrusted input.

medium: broad permissions, unclear auth boundary, unpinned remote code, weak logging of sensitive data.

low: missing docs, weak error handling, optional hardening.

info: posture notes without a concrete abuse path.

Output

# Safety Review Verdict: Severity: Confidence: Why it matters: Evidence: Required mitigations: Install decision:

Hard rule: do not run raw binaries, zips, curl-piped scripts, or package installers from a fresh repo until this review is complete.

Pair With

$auto-skill-safety-mcp-secret-guard when configs, logs, or examples may contain credentials.

$auto-skill-build-mcp-conformance-harness after the server is trusted and the user needs repeatable CI/release gates.

Validation

Every exposed tool is classified by read/write/destructive/account-control capability.

Install/run decision states what was not executed.

Required mitigations are concrete enough to apply before trust is expanded.

mcp-safety-review