Purpose
Triage the risk of an MCP server before it gains access to the session. An enabled server's tools execute with real filesystem, network, and credential reach; the review happens before enablement, not after the first incident.
When to Use
- A staged MCP server config is a candidate for enabling
- A third-party MCP server is proposed from outside the repo
- An existing server entry changes transport, credentials, or tool surface
- A long-enabled server is due a periodic re-review
For filesystem-server path boundaries in depth, continue with the filesystem-mcp-guardrails skill after this triage.
Inputs
- The server config entry: command, args, env, transport
- The server's declared tool list (from its manifest or a smoke run)
- What the session can reach if the server misbehaves
Workflow
Launch vector. Pinned, locally installed binaries beat remote latest-version execution:
rg -n 'npx -y|@latest|curl .*\| *sh' <config-file>
Unpinned remote execution is a P1 by default — the server reviewed today is not necessarily the server that runs tomorrow.
Transport and exposure. A local stdio process is the conservative default. Network transports must answer: who can connect, is it loopback-only, is there authentication.
Credentials and environment. Hardcoded secrets in the config are P0. Environment pass-through should name specific variables — never forward the whole environment.
Tool surface. Enumerate the tools the server actually declares. Write, exec, and delete capabilities raise the bar; a read-only server with three tools is a different risk class from a shell-capable one with thirty.
Scope boundaries. Paths bounded to the workspace, method filtering configured, timeouts set.
Repo-native checks, then approval. For staged Agent Powerups configs, run the availability checks, then stop for explicit user approval before enabling:
apx mcp check <name>
apx mcp smoke <name>
These verify availability and declared dependencies only — they are not a substitute for the review above, and passing them does not authorize enablement.
Output
- A risk verdict: enable, constrain-then-enable, or reject
- Findings with level (P0 secret or unbounded exec, P1 unpinned or over-broad, Note) and a concrete remediation each
- Unanswered questions stated as open risks when information was unavailable
Verification
Failure Modes
- Smoke-test-as-review — a passing smoke run proves the server starts, not that it is safe.
- Trusting the README tool list — enumerate from the server's declared tools; docs drift.
- Wildcard env pass-through — handing the whole environment to a subprocess leaks every credential the session holds.
- Enable-then-review — once tools are live, the first malicious call has already happened.
1---2name: mcp-risk-review3description: Use when an MCP server is about to be enabled, added to agent config, or upgraded -- a staged server config is a candidate for activation, a third-party server is proposed from a registry, or an existing entry changes transport, credentials, or tool surface.4---56## Purpose78Triage the risk of an MCP server before it gains access to the session. An enabled server's tools execute with real filesystem, network, and credential reach; the review happens before enablement, not after the first incident.910## When to Use1112- A staged MCP server config is a candidate for enabling13- A third-party MCP server is proposed from outside the repo14- An existing server entry changes transport, credentials, or tool surface15- A long-enabled server is due a periodic re-review1617For filesystem-server path boundaries in depth, continue with the filesystem-mcp-guardrails skill after this triage.1819## Inputs2021- The server config entry: command, args, env, transport22- The server's declared tool list (from its manifest or a smoke run)23- What the session can reach if the server misbehaves2425## Workflow26271. **Launch vector.** Pinned, locally installed binaries beat remote latest-version execution:2829 ```sh30 rg -n 'npx -y|@latest|curl .*\| *sh' <config-file>31 ```3233 Unpinned remote execution is a P1 by default — the server reviewed today is not necessarily the server that runs tomorrow.34352. **Transport and exposure.** A local stdio process is the conservative default. Network transports must answer: who can connect, is it loopback-only, is there authentication.36373. **Credentials and environment.** Hardcoded secrets in the config are P0. Environment pass-through should name specific variables — never forward the whole environment.38394. **Tool surface.** Enumerate the tools the server actually declares. Write, exec, and delete capabilities raise the bar; a read-only server with three tools is a different risk class from a shell-capable one with thirty.40415. **Scope boundaries.** Paths bounded to the workspace, method filtering configured, timeouts set.42436. **Repo-native checks, then approval.** For staged Agent Powerups configs, run the availability checks, then stop for explicit user approval before enabling:4445 ```sh46 apx mcp check <name>47 apx mcp smoke <name>48 ```4950 These verify availability and declared dependencies only — they are not a substitute for the review above, and passing them does not authorize enablement.5152## Output5354- A risk verdict: enable, constrain-then-enable, or reject55- Findings with level (P0 secret or unbounded exec, P1 unpinned or over-broad, Note) and a concrete remediation each56- Unanswered questions stated as open risks when information was unavailable5758## Verification5960- [ ] Launch vector, transport, credentials, tool surface, and boundaries were each explicitly assessed61- [ ] The tool list came from the server's actual declaration, not an assumption62- [ ] Availability checks were run for staged configs63- [ ] No server was enabled without explicit user approval after the verdict6465## Failure Modes6667- **Smoke-test-as-review** — a passing smoke run proves the server starts, not that it is safe.68- **Trusting the README tool list** — enumerate from the server's declared tools; docs drift.69- **Wildcard env pass-through** — handing the whole environment to a subprocess leaks every credential the session holds.70- **Enable-then-review** — once tools are live, the first malicious call has already happened.
yeaight7