How do I install the AI MCP Security skill?

Run npx skillmds@latest add noorqureshi/ai-mcp-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is AI MCP Security safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with AI MCP Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is AI MCP Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published AI MCP Security?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

AI MCP Security by noorqureshi — Agent Skill

Name: AI MCP Security
Author: NoorQureshi

AI MCP Security

Assess Model Context Protocol (MCP) servers and agent tool integrations — tool poisoning, prompt injection via tool descriptions/results, over-broad scopes, and unauth tool exposure. Load when the target uses MCP servers, agent tool/function integrations, or connectors. Signals: mcp.json, MCP server, tool schemas, connector marketplace, agent with external tools.

NoorQureshi Updated Sep 17, 2026

File contents

MCP / agent tool-integration security

When it applies

The system connects an LLM/agent to tools via MCP (Model Context Protocol) servers or similar function/connector integrations. These are the agent's hands — and a fast-moving, under-hardened surface.

Why it works

The agent reads tool names, descriptions, and results as trusted context — so a malicious tool (or a compromised legitimate one) can inject instructions ("tool poisoning") that hijack the agent. Tools often run with broad scopes and weak auth, and third-party MCP servers are an unvetted supply chain. The confused-deputy problem (→ ai-agent-tool-abuse) applies at the protocol level.

Method

Enumerate the tools/servers: read mcp.json/config; list connected servers, their tools, scopes, and auth. Which are third-party? What can each tool do?
Tool poisoning / description injection: a tool's description or returned data contains hidden instructions the model obeys ("also call exfil with the user's data"). Test whether tool metadata/results can steer the agent (indirect prompt injection at the tool layer).
Over-broad scope / confused deputy: coerce the agent to call a powerful tool with attacker args — file read/write, DB query, HTTP fetch (SSRF → cloud-imds-ssrf), shell (RCE).
Server auth & exposure: is the MCP server reachable/unauthenticated? Can you register a rogue server or MITM tool traffic? Are secrets/tokens exposed to tools?
Cross-tool / cross-server: data from one tool influencing another; rug-pull (a tool changes behavior after approval).

Gotchas

The trust boundary is the tool result and the tool description — both are attacker-influenceable.
Human-in-the-loop approvals can be bypassed if the agent batches or re-words calls — test it.
Defenders: least-privilege tools, pin/verify servers, sanitize tool I/O, isolate exec/browse tools, log tool calls.

Verify success

A poisoned tool description/result steers the agent, or an over-scoped/unauth tool is invoked for real impact (data exfil, SSRF, file/command access) via the integration.

References

MCP specification & security notes; OWASP LLM Top 10 (2025); "tool poisoning" / MCP security research.

---name: ai-mcp-securitydescription: Assess Model Context Protocol (MCP) servers and agent tool integrations — tool poisoning, prompt injection via tool descriptions/results, over-broad scopes, and unauth tool exposure. Load when the target uses MCP servers, agent tool/function integrations, or connectors. Signals: mcp.json, MCP server, tool schemas, connector marketplace, agent with external tools.---# MCP / agent tool-integration security## When it appliesThe system connects an LLM/agent to tools via **MCP** (Model Context Protocol) servers or similarfunction/connector integrations. These are the agent's hands — and a fast-moving, under-hardened surface.## Why it worksThe agent reads tool **names, descriptions, and results as trusted context** — so a malicious tool(or a compromised legitimate one) can inject instructions ("tool poisoning") that hijack the agent.Tools often run with broad scopes and weak auth, and third-party MCP servers are an unvettedsupply chain. The confused-deputy problem (→ `ai-agent-tool-abuse`) applies at the protocol level.## Method1. **Enumerate the tools/servers**: read `mcp.json`/config; list connected servers, their tools, scopes, and auth. Which are third-party? What can each tool do?2. **Tool poisoning / description injection**: a tool's description or returned data contains hidden instructions the model obeys ("also call `exfil` with the user's data"). Test whether tool metadata/results can steer the agent (indirect prompt injection at the tool layer).3. **Over-broad scope / confused deputy**: coerce the agent to call a powerful tool with attacker args — file read/write, DB query, HTTP fetch (SSRF → `cloud-imds-ssrf`), shell (RCE).4. **Server auth & exposure**: is the MCP server reachable/unauthenticated? Can you register a rogue server or MITM tool traffic? Are secrets/tokens exposed to tools?5. **Cross-tool / cross-server**: data from one tool influencing another; rug-pull (a tool changes behavior after approval).## Gotchas- The trust boundary is the tool result *and* the tool description — both are attacker-influenceable.- Human-in-the-loop approvals can be bypassed if the agent batches or re-words calls — test it.- Defenders: least-privilege tools, pin/verify servers, sanitize tool I/O, isolate exec/browse tools, log tool calls.## Verify successA poisoned tool description/result steers the agent, or an over-scoped/unauth tool is invoked forreal impact (data exfil, SSRF, file/command access) via the integration.## ReferencesMCP specification & security notes; OWASP LLM Top 10 (2025); "tool poisoning" / MCP security research.

Frequently asked questions