skills.rest
selfagency
selfagencyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

mcp-security-audit

Audit .mcp.json files for secrets, injection risks, and unpinned dependencies.

Updated Mar 11, 2026
Search Tags:#security#mcp#governance#secrets#supply-chain#configuration-audit#shell-injection
One-click install
npx skills add https://github.com/selfagency/agentsy --skill mcp-security-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mcp-security-audit
Source: https://github.com/selfagency/agentsy/tree/main/.agents/skills/mcp-security-audit
Command: npx skills add https://github.com/selfagency/agentsy --skill mcp-security-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents insecure MCP server configurations from exposing secrets, enabling shell injection, or introducing supply-chain risk during agent tool execution.

Core Features & Use Cases

  • Secrets Exposure Detection: Finds hardcoded credentials and tokens embedded in MCP server args or config env fields.
  • Shell Injection Pattern Detection: Flags dangerous command construction patterns that could lead to command execution or reverse-shell behavior.
  • Supply-Chain Risk Checks: Identifies unpinned versions such as @latest usage and highlights potentially interactive npx invocation behavior in CI.
  • Use Case: Before deploying an agent that uses MCP tools, scan a project’s .mcp.json to produce a severity-based report and clear remediation guidance.

Quick Start

Ask the AI to audit your project's .mcp.json for hardcoded secrets, shell injection patterns, unpinned versions, and unapproved MCP server registrations.

Frequently Asked Questions about mcp-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan .mcp.json files for exposed secrets and security flaws?▼

Scanning .mcp.json files for security flaws involves auditing server commands and args to detect hardcoded secrets, shell injection indicators, and unpinned dependencies, producing a per-server severity report.

What is MCP configuration auditing and when do I need it?▼

MCP configuration auditing is the process of validating server commands, args, and env fields to prevent secret exposure and supply-chain risk. You need it before deploying agents that use MCP tools.

How do I detect shell injection patterns in MCP server commands?▼

Detecting shell injection patterns in MCP server commands involves auditing the configuration file to flag dangerous command construction patterns that could enable command execution or reverse-shell behavior.

Does this security audit check for unpinned npx dependencies like @latest?▼

Yes, the security audit checks for unpinned dependencies by identifying @latest version usage and highlighting potentially interactive npx invocation behavior that introduces supply-chain risk.

Can I audit multiple .mcp.json files across a monorepo?▼

Yes, you can audit .mcp.json files across a monorepo by scanning each project configuration to report per-server findings and an overall pass/fail security status.

Related Skills

Explore More Legal & Compliance Skills→
ecielamecielam

MCP Integration

Configure MCP servers as tools in Claude Code plugins via .mcp.json.

Community
Advanced
UnicornUnicorn

security-audit-agent

Scans code for vulnerabilities, generating reports with severity and remediation suggestions.

Official
Advanced
paultyngpaultyng
9

review-ci

Audit CI/CD pipeline configurations for security and supply chain risks.

Community
Advanced
sovriumsovrium
3

security-scanner

Identify security vulnerabilities in codebases via static analysis.

Official
Advanced