Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentsmcp server security audit
Static security auditor for MCP servers to detect injection, confused-deputy, and scope-creep vulnerabilities.
Free
mcp server security audit
Example session with this skill installed
Audit the handlers in src/tools/db_query.ts against their descriptions. Check for SQL injection and ensure tenant_id is derived from the auth token, not the tool arguments.
- Read your context and instructions
- Compiled the mcp server security
Finding: MCP02 (Injection) in src/tools/db_query.ts:42. The 'query' argument is concatenated directly into the raw SQL string. Finding: MCP03 (Confused Deputy) in src/tools/db_query.ts:58. The tenant_id check uses a caller-supplied parameter, allowing cross-tenant access via CWE-639.
Connects securely to your tools. The creator never sees your data.
About this skill
The problem
MCP servers often have dangerous drift between tool descriptions and their actual handler code. Developers risk shipping RCE vulnerabilities through unsanitized inputs or leaking tenant data due to confused-deputy patterns in multi-client environments.
What it does
- Performs side-by-side audits of tool docstrings against handler implementations to detect functional drift.
- Traces caller-supplied arguments to identify injection surfaces in shell commands, SQL queries, and file paths.
- Detects confused-deputy vulnerabilities in multi-tenant servers by verifying if authorization checks rely on verified identities or unvalidated tool arguments.
- Identifies over-broad scope declarations and omnibus permissions that violate the principle of least privilege.
- Audits stateful servers for session-handle hijacking risks and shared-mutable-state leaks across concurrent connections.
Frameworks & tools
Model Context Protocol (MCP), OAuth 2.0 (RFC 8707), OWASP MCP Top 10, CVE-2026-54052, CVE-2026-0755, CVE-2026-25536.
Why this beats prompting it yourself
Generic security prompts miss the specific architectural failures unique to the MCP specification, like token passthrough and state-handle binding. This skill enforces a strict multi-step workflow grounded in recent real-world CVEs and primary-source specification requirements.
Use cases
- Reviewing a new MCP server handler for injection risks before its first release.
- Auditing a multi-tenant MCP gateway to ensure tenant isolation isn't bypassable via tool parameters.
- Hardening an existing server by narrowing requested scopes to match actual tool requirements.
- Preparing a formal pre-ship security checklist for third-party review or internal compliance.
Known limitations
Static source review only. It cannot perform dynamic testing against a running server or audit external gateway configurations, environment variables, or CORS policies.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
2 installs
Downloaded by developers to date
Free forever
No account required to browse
Trust & safety
Security scanned
Verified clean 1 month ago
- Free to download with an account