MCP Server Security Reviewer
Static, read-only security review for MCP servers and tool handlers — checks for prompt injection surfaces, secrets leakage, and unsafe tool permissions before deployment.
MCP Server Security Reviewer is a free AI skill for safety, privacy & compliance. Static, read-only security review for MCP servers and tool handlers — checks for prompt injection surfaces, secrets leakage, and unsafe tool permissions before deployment. It works with Claude, Claude Code, Cursor and is ready to use out of the box.
About this skill
MCP servers give AI agents real capabilities — file access, API calls, database queries — which means a poorly written tool handler is a genuine security surface, not just a bug. This skill performs a static, read-only review of MCP server code: it checks for prompt-injection paths (untrusted tool output flowing back into model context unsanitized), hardcoded secrets or overly broad environment variable access, tool permission scope that's wider than the tool's stated purpose needs, and missing input validation on tool arguments. It never writes exploit code or attempts to actually breach anything — it produces a severity-ranked list of findings and concrete fixes, meant to run before a server goes live or gets listed publicly.
What it does
Given MCP server source code, the skill statically reviews tool handler definitions and surrounding code for prompt-injection surfaces (unsanitized external content reaching the model), secrets or credential exposure, excessive permission scope relative to stated tool purpose, and missing argument validation, then returns findings grouped by severity with a specific fix for each.
What is included
- Full SKILL.md with the MCP-specific review checklist (injection surfaces, secrets, permission scope, input validation)
- Severity ranking guide: critical / warning / suggestion, with clear criteria for each
- Explicit non-goals section: this is a defensive static reviewer, not a penetration-testing or exploit-writing tool
- Guidance for reviewing tool descriptions themselves for injection risk, not just the handler code
- Worked example: findings from reviewing a sample MCP tool handler with a hardcoded API key and unsanitized output
How to use it
1. Download the mcp-server-security-reviewer-SKILL.md file 2. Add it to your agent's skills folder (e.g. .claude/skills/ for Claude Code) or upload it in a Claude.ai/Cursor chat 3. Point it at your MCP server's source (tool definitions and handlers) 4. Review the severity-ranked findings and apply the suggested fixes before deployment or public listing
Examples
Review this MCP tool handler for security issues before I publish it. [pastes a Python MCP tool that fetches a URL and returns the raw page content to the model, with an API key defined as a string literal in the file]
Critical: API key is hardcoded as a string literal in the handler file rather than loaded from an environment variable or secrets manager — fix by moving it to an env var and adding the file to .gitignore if not already. Critical: raw fetched page content is returned to the model with no sanitization, meaning any instructions embedded in that page (prompt injection) reach the model directly — fix by stripping or clearly delimiting external content so the model can distinguish it from trusted instructions. Warning: no input validation on the URL argument, allowing requests to internal/local addresses (SSRF risk) — fix by validating against an allowlist or blocking private IP ranges.
FAQ
Does this actually try to attack or exploit my MCP server?
What's the most common finding it catches?
Does it check the tool description text, or only the handler code?
What languages does it work with?
Will it flag a broad file-system tool as unsafe even if that's the intended design?
Should this replace a professional security audit before a public release?
Related Skills
Vendor & Third-Party Risk Assessor
Reviews a described vendor or third-party tool for data, security, and dependency risk before you sign, returning a rated checklist with the real blockers.
Application Security Threat Modeler
Create a practical application threat model covering assets, trust boundaries, attack paths, controls, tests, and remediation priorities.
AI Governance & Compliance Checklist
Reviews an AI-related workflow, tool, or output against a practical governance checklist covering data privacy, bias, accountability, and transparency.
Related Prompts
Vendor Security & Compliance Risk Review
Systematically evaluate a third-party vendor or tool for security, data privacy, and compliance risk before integrating it into your business.
Prompt Injection & Tool-Use Risk Audit
Review an AI agent or tool-enabled workflow for prompt injection, untrusted content, excessive permissions, unsafe actions, and missing approval gates.
System Prompt Robustness Audit
Stress-test a system prompt for ambiguity, conflicting instructions, and jailbreak vulnerability, then receive a rewritten, hardened version.
Related Articles
AI Agent Skills Are Becoming a Software Supply Chain
Reusable AI skills make agents more capable, but they also create a new software supply chain. Learn why curation, scanning, permissions, provenance, and review are now essential.
AI Agent Safety Moves From Theory to Product Details
AI safety is becoming more practical, focused on permissions, monitoring, refusal quality, provenance, and human review.
AI Safety Benchmarks Show Residual Risk Is Not Gone
AI safety is becoming more practical, focused on permissions, monitoring, refusal quality, provenance, and human review.