mcp-defense

Name: mcp-defense
Availability: InStock
Author: brucebanner010198-commits

Pin MCP tool descriptions and schemas to prevent unsafe adoption.

Updated Apr 21, 2026

Search Tags:#security #mcp #governance #adrs #runtime-security #tool-adoption #hash-pinning

Ready to run

npx skills add https://github.com/brucebanner010198-commits/DevSecOps-Agency --skill mcp-defense

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: mcp-defense
Source: https://github.com/brucebanner010198-commits/DevSecOps-Agency/tree/main/skills/mcp-defense
Command: npx skills add https://github.com/brucebanner010198-commits/DevSecOps-Agency --skill mcp-defense

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

MCP-specific threat playbook helps governance of MCP tool adoption by pinning descriptions, detecting dangerous content, and enforcing ADR-based approvals.

Core Features & Use Cases

Pinning and drift-detection: hash-pin MCP tool descriptions and input schemas to prevent drift and unauthorized changes.
Threat-instrumentation checks: scan for instruction-like content in tool manifests and assess for over-permission scenarios.
Governance & ADRs: generate adoption ADRs and enforce gated registration via secrets vaults.
Runtime safeguards: apply pre-call checks and envelope-wrapped tool metadata to prevent data leakage and injection.

Quick Start

Register a new MCP server and run this skill to validate tool descriptions against the hash registry and generate an ADR.

Frequently Asked Questions about mcp-defense

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent unauthorized changes to MCP tool descriptions and schemas?▼

MCP tool descriptions and schemas are secured using hash-pinning to prevent drift. This process validates tool manifests against a registered hash, detecting and preempting any unauthorized modifications during server adoption and runtime invocation.

What is hash-drift detection in MCP server adoption?▼

Hash-drift detection is a mechanism that pins MCP tool descriptions and input schemas to a known hash. It monitors these manifests during adoption and runtime to identify and preempt dangerous configuration changes or unauthorized content alterations.

How do I enforce governance and ADR documentation for MCP tool adoption?▼

MCP tool governance enforces ADR-based approvals by generating Architecture Decision Records for new tool adoption. It applies gated registration via secrets vaults to ensure tools meet documentation and security requirements before activation.

Can I scan MCP tool manifests for instruction-like content and over-permission threats?▼

Threat-instrumentation checks scan MCP tool manifests for instruction-like content and assess over-permission scenarios. These checks run during server adoption to identify dangerous configurations and prevent data leakage or injection risks.

How do I apply runtime safeguards to prevent data leakage in MCP tools?▼

Runtime safeguards apply pre-call checks and envelope-wrapped tool metadata to prevent data leakage and injection. These checks execute during runtime invocation to validate tool safety before any dangerous configuration can process data.

Do I need a secrets vault to gate MCP server registration?▼

A secrets vault is required to enforce gated registration for MCP servers. It ensures that tool adoption is restricted through ADR documentation and hash-drift detection, preventing unsafe tools from registering without proper credential governance.