mcp-server-review

Name: mcp-server-review
Availability: InStock
Author: OWASP

Audits MCP server implementations for security risks across seven defined review areas.

141|14|Updated Mar 22, 2026

Search Tags:#injection #mcp #auditing #server #model-context-protocol #security-review #data-exposure

Ready to run

npx skills add https://github.com/OWASP/secure-agent-playbook --skill mcp-server-review-owasp

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: mcp-server-review
Source: https://github.com/OWASP/secure-agent-playbook/tree/main/skills/mcp-server-review
Command: npx skills add https://github.com/OWASP/secure-agent-playbook --skill mcp-server-review-owasp

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams need a repeatable, evidence-based way to audit MCP (Model Context Protocol) server implementations for misconfigurations, insecure defaults, and data exposure.

Core Features & Use Cases

Structured evaluation of transport, authentication, and tooling against the MCP model.
Risk classification for each exposed tool (READ-ONLY, MUTATION, DESCRIPTIVE, NETWORK, CREDENTIAL-ACCESS) with concrete remediation guidance.
Data exposure & scope checks to prevent leakage, sandbox violations, and supply chain risks.
Use Case: Before deploying a new MCP server or integrating Claude Code, run this review to validate configuration and code quality.

Quick Start

Follow the MCP server security review procedure to audit a given MCP server implementation.

Frequently Asked Questions about mcp-server-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit an MCP server for security risks before deployment?▼

Auditing an MCP server for security risks involves evaluating transport, tool permissions, input validation, data exposure, sandboxing, supply chain, and client configuration through a structured review workflow to identify misconfigurations and data leakage.

What is MCP server security review and when do I need it?▼

MCP server security review is a structured evaluation of Model Context Protocol implementations against security risks. You need it before deploying new MCP servers or integrating Claude Code to validate configuration and code quality.

How do I classify tool risks in a Model Context Protocol deployment?▼

Classify tool risks in a Model Context Protocol deployment by categorizing exposed tools into READ-ONLY, MUTATION, DESCRIPTIVE, NETWORK, and CREDENTIAL-ACCESS levels, then applying concrete remediation guidance for each classification.

Does this security review cover supply chain and sandboxing controls for MCP servers?▼

Yes, this security review covers supply chain verification and sandboxing controls for MCP servers, performing scope checks to prevent leakage, sandbox violations, and supply chain risks during the auditing workflow.

What's the best way to validate Claude Code integrations for data exposure?▼

The best way to validate Claude Code integrations for data exposure is running a structured security review that checks scope boundaries, input validation, and client configuration to prevent leakage and insecure defaults.

What data exposure checks are included in an MCP server audit?▼

An MCP server audit includes data exposure checks that review scope boundaries, sandbox violations, and client configuration to prevent leakage and insecure defaults in Model Context Protocol implementations.