# MCP Server Review

> Security review of MCP (Model Context Protocol) server implementations and configurations. Use when auditing MCP server source code, evaluating third-party MCP servers before installation, or reviewing Claude Code MCP integrations for overpermissioning, injection risks, and data exposure.

- Skill: `owasp/mcp-server-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add owasp/mcp-server-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/owasp/mcp-server-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- License: CC-BY-4.0
- Author: OWASP (https://skillmd.com/u/owasp)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/owasp/mcp-server-review

---


# MCP Server Security Review

Audit an MCP server by following the full procedure in `plays/mcp-server-review.md`.

## Steps

1. **Transport & Authentication** — Check transport type (stdio vs HTTP/SSE), authentication on network transports, TLS enforcement, CORS policy, origin validation.

2. **Tool Permission Audit** — For each exposed tool: document what it claims to do vs what it actually does (read source). Classify as READ-ONLY, MUTATION, DESTRUCTIVE, NETWORK, or CREDENTIAL-ACCESS. Flag tools with broader capabilities than descriptions suggest, free-form inputs, or credential access.

3. **Input Validation & Injection** — For each tool parameter: check for command injection (shell interpolation), path traversal (../ in file paths), SQL injection (unparameterized queries), SSRF (user-supplied URLs hitting internal services), and template injection.

4. **Data Exposure** — Assess MCP resources for secrets/PII leakage, tool outputs for excessive data, error messages for internal paths/stack traces, and logging for sensitive data capture.

5. **Scope & Sandboxing** — Check file system restrictions, network scope (can it reach cloud metadata 169.254.169.254?), process permissions, resource limits, and dependency surface.

6. **Supply Chain** — Verify source trustworthiness, run SCA on dependencies, check for lockfiles and reproducible builds, assess update mechanism.

7. **Client Configuration** — Review MCP client config for absolute/specific server paths, minimized env var passthrough, and command injection safety in args.

## Output

Server overview, tool risk matrix, findings using `templates/finding.md`, and specific configuration recommendations.

## OWASP References

- LLM01: Prompt Injection (via tool descriptions and outputs)
- LLM02: Insecure Output Handling
- LLM06: Excessive Agency (overpermissioned tools)
- A01: Broken Access Control
- A03: Injection