Menu

Individual skill

mcp-server-audit

Security audit of Model Context Protocol (MCP) servers — tool poisoning, prompt injection via tool descriptions and results, unscoped/over-privileged tools, path traversal in file tools, command injection in shell/exec tools, SSRF in fetch tools, secret leakage through tool output, missing approval gates on state-changing actions, confused-deputy and rug-pull tool redefinition, token passthrough, and unsafe stdio/HTTP transport config. Covers auditing both first-party and third-party MCP servers (Python FastMCP, Node MCP SDK) and their client configs (Claude Desktop, Cursor, Cline, Windsurf, Zed). Use when reviewing, hardening, or hunting bugs in an MCP server, an agent's tool integrations, or a mcpServers config block. 中文触发词：MCP审计、工具投毒、提示注入、智能体安全、MCP服务器漏洞

skills/mcp-server-audit/SKILL.md

Read pinned source

Source commit 8060af0c1b0b6ecc6595ee3261f50aa613038620

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
No
Observed behavior
Not checked yet
Last checked
Nov 3, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
5,704
Repository last updated
Oct 28, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# MCP SERVER SECURITY AUDIT

> An MCP server hands an AI agent real capabilities — files, shells, network, APIs. The trust boundary is the tool call. Every tool description is prompt the model reads, every tool result is data the model may act on, and every side-effecting tool is an action taken on someone's behalf. Audit all three.

---

## THE ONLY QUESTION THAT MATTERS

> **"Can untrusted input — a tool description, a fetched page, a file's contents, another server's output — cause this agent to run an action the user never approved, leak a secret, or reach a resource outside scope?"**
>
> If yes, that's the bug. If no, move on. Theoretical "a malicious server could…" without a reachable path is not a finding — show the path.

---