Run any Skill in Manus with one click

mcp-security-review

Stars2

Forks0

UpdatedJuly 8, 2026 at 04:02

Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

tvnkhoa

tvnkhoa/mcp-local

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	mcp-security-review
description	Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

MCP Security Review

When to Use

Any DB-related MCP tool change.
Any change touching SQL validation or query execution.
Pre-merge review for MCP safety posture.

Review Checklist

Privilege
- Is behavior least-privilege by default?
- Are mutating operations explicitly requested and bounded?
SQL Guardrails
- Single-statement enforcement present?
- Dangerous tokens blocked for read-only paths?
- Query timeout and result limits enforced?
Input Safety
- Inputs validated via schema (zod)?
- Query args parameterized?
Secrets & Logging
- No hardcoded secrets/tokens/connection strings.
- Logs avoid sensitive payloads and full raw SQL where risky.
Error Surfaces
- Error messages actionable but not sensitive.
Docs & Operability
- README.md updated for tool inputs/limits/examples.

Output Format

Pass/fail summary.
List of findings with severity: high|medium|low.
Concrete remediation suggestions.

More from this repository

same repository

key

tvnkhoa/mcp-local

"Browse Bitbucket Cloud repositories and pull requests, read PR diffs, and create pull requests via the {{DISPLAY_NAME}}. Triggers on: list repos/branches/PRs, view a pull request or its diff, open/create a PR. PR creation is gated and supports dryRun."

2026-07-082

db-parameterization-audit

tvnkhoa/mcp-local

Audit SQL construction to ensure parameterized execution, anti-concatenation posture, and read-only safety.

2026-07-082

db-query-budgeting

tvnkhoa/mcp-local

Control DB query budget with timeout, row limits, and concurrency caps to prevent abuse and resource exhaustion.

2026-07-082

mcp-contract-conformance

tvnkhoa/mcp-local

Validate MCP contract stability for tools/list, tools/call, schemas, and backward compatibility before merge or release.

2026-07-082

mcp-error-taxonomy

tvnkhoa/mcp-local

Standardize MCP errors into user-actionable vs developer/internal classes with stable codes and safe messages.

2026-07-082

mcp-host-integration-security

tvnkhoa/mcp-local

Harden MCP host/client integration with token hygiene, scope minimization, transport safeguards, and policy checks.

2026-07-082

name	mcp-security-review
description	Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

MCP Security Review

When to Use

Any DB-related MCP tool change.
Any change touching SQL validation or query execution.
Pre-merge review for MCP safety posture.

Review Checklist

Privilege
- Is behavior least-privilege by default?
- Are mutating operations explicitly requested and bounded?
SQL Guardrails
- Single-statement enforcement present?
- Dangerous tokens blocked for read-only paths?
- Query timeout and result limits enforced?
Input Safety
- Inputs validated via schema (zod)?
- Query args parameterized?
Secrets & Logging
- No hardcoded secrets/tokens/connection strings.
- Logs avoid sensitive payloads and full raw SQL where risky.
Error Surfaces
- Error messages actionable but not sensitive.
Docs & Operability
- README.md updated for tool inputs/limits/examples.

Output Format

Pass/fail summary.
List of findings with severity: high|medium|low.
Concrete remediation suggestions.