MCP Security Audit
Checks .mcp.json entries before an agent is allowed to load them.
Install
gh skills install github/awesome-copilot mcp-security-audit
.mcp.json değiştiğinde, projeye yeni bir MCP sunucusu alınırken veya ajanın araç yapılandırması güvenlik açısından gözden geçirilirken
- Author
- Imran Siddique
- License
- MIT
An MCP server hands the agent direct access to whatever it wraps, so the config file deserves the same scrutiny as a dependency manifest. The audit walks each server entry looking for credentials written straight into args or env, command shapes that permit shell injection, versions left floating on @latest instead of pinned, and servers that are not on the project's approved list. Output is a per-server report rather than a pass/fail, which makes it usable as a pre-commit check on config changes or when a new server is introduced to a monorepo.
Similar skills
MCP CLI
SkillCalls MCP servers from the command line instead of wiring them in permanently.
Claude Code Setup
SkillReads a codebase and recommends the hooks, skills, MCP servers and subagents worth adding.
Deployment Validation
SkillChecks configuration against a schema before a release rather than after it fails.
Comments(0)
Sign in to comment