MCP Config Security Audit
Use this skill before enabling a new MCP server or after changing an existing MCP configuration.
Required flow
- 1. Copy the MCP configuration into a temporary review file. Replace real secrets with environment references before processing.
- Select or customize a policy based on
references/policy.md. - Run
scripts/audit_mcp_config.py and review PASS, REVIEW, and BLOCK results. - Do not start BLOCK entries. Do not start REVIEW entries until a human accepts the exact remediation and capability scope.
Command
CODEBLOCK0
Safety rules
- - Never place real tokens, passwords, cookies, private keys, or connection strings in the review file.
- Treat local stdio servers as applications with the same file, process, and network access as their execution account.
- Require pinned package versions for package runners such as
npx and uvx. - Block shell pipelines, encoded commands, download-and-execute patterns, plaintext credentials, non-HTTPS remote servers, and disallowed domains.
- Review broad filesystem roots, legacy protocol versions, automatic package installation, and write/delete/payment/send/admin capabilities.
- The audit is static. A PASS does not prove that server code is trustworthy or vulnerability-free.
Outputs
- -
audit_report.json: overall gate and counts. - INLINECODE5 : risk score, decision, findings, and remediations per server.
- INLINECODE6 : entries that need human approval.
- INLINECODE7 : entries that must not start.
- INLINECODE8 : redacted review copy.
- INLINECODE9 : prioritized fixes.
Recovery
- - Plaintext secret: remove it, rotate any exposed credential, and use an environment or vault reference.
- Unpinned package: pin an exact reviewed version and verify its package source.
- Broad root: replace it with the smallest required directory.
- Legacy protocol: check client/server compatibility and follow official migration notes.
- High-risk capability: split read and write servers or require human approval for side effects.
