MCP Security Reviewer
When to use
- A new MCP server is being added to an agent
- An MCP server version is being bumped
- An incident triggered a re-review
Inputs
| Name | Type | Required | Notes |
|---|---|---|---|
repo_url |
string | yes | the MCP server's source |
version |
string | yes | tag or commit SHA being adopted |
intended_use |
string | yes | one paragraph: what we'll let it do |
Workflow
- Source review: clone at the pinned version; check for unexpected files / scripts
- Capabilities: list every tool and resource exposed; map to risk levels (
references/mcp-risk-matrix.md) - Network: identify outbound endpoints; document and assess each
- Permissions: minimum required scopes / tokens; document over-permissions
- Output handling: confirm the agent treats tool output as untrusted (sanitization, no execution)
- Approvals: define which tools require human approval
- Produce filled
MCP_SERVER.mdinmcp/<server>.md
References
references/mcp-risk-matrix.md
Success criteria
- All tools labelled by risk
- High/Critical tools gated by approval
- Pinned version (no
latest/ floating refs) - Documented network egress
Failure modes
- Source unavailable / un-pinnable → reject
- Discovered hidden tool not in docs → reject and report upstream