Agent skill · security · github
mcp-security-audit
Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: - Reviewing .mcp.json files for security risks - Checking MCP server args for hardcoded secrets or shell injection patterns - Validating that MCP servers use pinned versions (not @latest) - Detecting unpinned dependencies in MCP server configurations - Auditing which MCP servers a project registers and whether they're on an approved list - Checking for environment variable usage vs. hardcoded credentials in MCP configs - Any request like "is my MCP config secure?", "audit my MCP servers", or "check .mcp.json" keywords: [mcp, security, audit, secrets, shell-injection, supply-chain, governance]
Why this skill is useful
Adds executable scripts for auditing MCP configurations that detect security vulnerabilities not covered in standard practices.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
MCP Security Audit Audit MCP server configurations for security issues — secrets exposure, shell injection, unpinned dependencies, and unapproved servers. Overview MCP servers give agents direct tool access to external systems. A misconfigured .mcp.json can expose credentials, allow shell injection, or connect to untrusted servers. This skill catches those issues before they reach production. When to Use Reviewing any .mcp.json file in a project Onboarding a new MCP server to a project Auditing all MCP servers in a monorepo or plugin marketplace Pre-commit checks for MCP configuration changes Security review of agent tool configurations --- Audit Check 1: Hardcoded Secrets Scan MCP server args and env values for hardcoded credentials. Good practice — use env var references: Bad — hardcoded credentials: --- Audit Check 2: Shell Injection Patterns Detect dangerous command patterns in MCP server args. --- Audit Check 3: Unpinned Dependencies Flag MCP servers using @latest in their package references. Good — pinned version: Bad — unpinned: --- Audit Check 4: Full Audit Runner Combine all checks into a single audit. Usage: --- Output Format --- Related Resources MCP Specification Agent Governance Toolkit — Full governance framework with MCP trust proxy OWASP ASI-02: Insecure Tool Use
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/mcp-security-audit