Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

mcp-security-review

Estrellas2

Forks0

Actualizado8 de julio de 2026 a las 04:02

Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

tvnkhoa

tvnkhoa/mcp-local

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	mcp-security-review
description	Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

MCP Security Review

When to Use

Any DB-related MCP tool change.
Any change touching SQL validation or query execution.
Pre-merge review for MCP safety posture.

Review Checklist

Privilege
- Is behavior least-privilege by default?
- Are mutating operations explicitly requested and bounded?
SQL Guardrails
- Single-statement enforcement present?
- Dangerous tokens blocked for read-only paths?
- Query timeout and result limits enforced?
Input Safety
- Inputs validated via schema (zod)?
- Query args parameterized?
Secrets & Logging
- No hardcoded secrets/tokens/connection strings.
- Logs avoid sensitive payloads and full raw SQL where risky.
Error Surfaces
- Error messages actionable but not sensitive.
Docs & Operability
- README.md updated for tool inputs/limits/examples.

Output Format

Pass/fail summary.
List of findings with severity: high|medium|low.
Concrete remediation suggestions.

Más de este repositorio

mismo repositorio

key

tvnkhoa/mcp-local

"Browse Bitbucket Cloud repositories and pull requests, read PR diffs, and create pull requests via the {{DISPLAY_NAME}}. Triggers on: list repos/branches/PRs, view a pull request or its diff, open/create a PR. PR creation is gated and supports dryRun."

2026-07-082

db-parameterization-audit

tvnkhoa/mcp-local

Audit SQL construction to ensure parameterized execution, anti-concatenation posture, and read-only safety.

2026-07-082

db-query-budgeting

tvnkhoa/mcp-local

Control DB query budget with timeout, row limits, and concurrency caps to prevent abuse and resource exhaustion.

2026-07-082

mcp-contract-conformance

tvnkhoa/mcp-local

Validate MCP contract stability for tools/list, tools/call, schemas, and backward compatibility before merge or release.

2026-07-082

mcp-error-taxonomy

tvnkhoa/mcp-local

Standardize MCP errors into user-actionable vs developer/internal classes with stable codes and safe messages.

2026-07-082

mcp-host-integration-security

tvnkhoa/mcp-local

Harden MCP host/client integration with token hygiene, scope minimization, transport safeguards, and policy checks.

2026-07-082

name	mcp-security-review
description	Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

MCP Security Review

When to Use

Any DB-related MCP tool change.
Any change touching SQL validation or query execution.
Pre-merge review for MCP safety posture.

Review Checklist

Privilege
- Is behavior least-privilege by default?
- Are mutating operations explicitly requested and bounded?
SQL Guardrails
- Single-statement enforcement present?
- Dangerous tokens blocked for read-only paths?
- Query timeout and result limits enforced?
Input Safety
- Inputs validated via schema (zod)?
- Query args parameterized?
Secrets & Logging
- No hardcoded secrets/tokens/connection strings.
- Logs avoid sensitive payloads and full raw SQL where risky.
Error Surfaces
- Error messages actionable but not sensitive.
Docs & Operability
- README.md updated for tool inputs/limits/examples.

Output Format

Pass/fail summary.
List of findings with severity: high|medium|low.
Concrete remediation suggestions.