mcp-implementation-security-review

Run a structured review that classifies the transport as network-exposed or local, checks baseline controls MCP-01 through MCP-05, analyzes seven RCE vectors, and scores the OWASP MCP Top 10. The output is a compliance report with file/line evidence for each finding.

Network-exposed MCP servers need per-request authentication with identity isolation, CSPRNG-generated session IDs that never act as credentials, runtime rate limiting keyed by identity, server-side input schema validation, and an official MCP SDK. Local STDIO servers receive best-practice guidance instead of hard pass/fail scoring.

Yes, but local STDIO servers are not scored PASS/FAIL on the five network baseline controls; they receive best-practice notes instead. RCE vector analysis still applies because tool input can execute locally, and network-dependent OWASP risks are marked N/A.

Seven vectors are checked: command injection, dynamic code evaluation, unsafe deserialization, path traversal, server-side template injection, dependency hijacking, and SSRF. Each is marked SAFE, AT RISK, or N/A based on direct code evidence with test payloads and CWE references.

Findings are marked NEEDS INVESTIGATION when compliance depends on evidence not visible in source code, such as deployment configuration, identity provider state, or SDK-managed session generation. The report lists these as manual follow-ups naming the artifact needed to verify them.