Security audit
Security checks for vulnerabilities and agentic risk
This MCP configuration skill is mostly coherent, but it gives copy-paste guidance that can persistently change agent integrations and run unpinned external packages without enough safety warnings.
Review this skill before installing. Use it only when you intentionally want help changing MCP configuration, pin package versions where possible, verify package publishers, avoid committing .mcp.json entries with secrets or machine-specific paths, and treat agent config files and debug logs as sensitive.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
# List all MCP servers and their connection status
claude mcp list
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
| Priority | File | Description |
|----------|------|-------------|
| 1 | `~/.claude.json` | **Claude Code global MCP config** (mcpServers section) |
| 2 | `~/.claude/settings.json` | Claude Code settings mcpServers |
| 3 | `~/.claude/settings.local.json` | Local overrides |
| 4 | `.mcp.json` (project root) | Project-level MCP config |
| 5 | `~/.config/claude/mcp.json` | User-level (legacy) |
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
|----------|------|-------------|
| 1 | `~/.claude.json` | **Claude Code global MCP config** (mcpServers section) |
| 2 | `~/.claude/settings.json` | Claude Code settings mcpServers |
| 3 | `~/.claude/settings.local.json` | Local overrides |
| 4 | `.mcp.json` (project root) | Project-level MCP config |
| 5 | `~/.config/claude/mcp.json` | User-level (legacy) |
| 6 | `~/.utcp_config.json` | UTCP-specific config |
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
ls -lt ~/.claude/debug/ | head -5
cat ~/.claude/debug/.txt
### 5. Manual Server Test
The trigger list includes broad phrases such as "MCP error", "MCP connection failed", and especially "code-mode not working", which can overlap with ordinary troubleshooting requests and cause the skill to activate in contexts where the user did not intend MCP configuration help. This is not code-execution dangerous by itself, but it can misroute the agent, increase exposure to unrelated configuration files, and produce incorrect or overly invasive guidance during normal support workflows.
The example instructs users to run an unpinned package via npx, which will resolve and execute the latest published version at install time. If the package is compromised, typo-squatted, or changed upstream, users could execute attacker-controlled code on their machine during MCP server setup.
This example again uses npx with an unpinned package name, creating a supply-chain risk because the fetched code is not fixed to a known-good version. In an MCP configuration skill, this is more dangerous because the guidance is procedural and likely to be copied verbatim by users configuring a trusted agent integration.
The postgres example encourages an MCP server to run with --access-mode=unrestricted and shows credentials embedded directly in DATABASE_URI without any warning about the security implications. In a configuration catalog intended for copy/paste use, this can normalize overly broad database access and secret exposure in shell history, config files, logs, or source control.
uvx/uv tool run commands without ==version create a rug-pull risk.
uvx/uv tool run commands without ==version create a rug-pull risk.
uvx/uv tool run commands without ==version create a rug-pull risk.
The example uvx mcp-server-qdrant describes invoking a package without an exact version. If a user follows this pattern, uvx may resolve and execute an unpinned current release, creating supply-chain risk similar to unpinned npx usage.
The documentation instructs users to run npx -y @utcp/code-mode-mcp without pinning an exact package version. Because npx resolves the latest published package by default, a future malicious or compromised release could be executed during troubleshooting, turning a diagnostic step into remote code execution on the user's machine.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
This is a second instance of the same unpinned npx -y @utcp/code-mode-mcp command, now combined with an environment variable. The environment variable does not reduce risk; the command still fetches and executes whatever version is current, which could be abused if the package supply chain is compromised.
The example shows a full plaintext DATABASE_URI containing embedded username and password, which normalizes unsafe secret handling in configuration documentation. In the context of an MCP configuration skill, users may copy this example directly into real config files, leading to credential exposure in dotfiles, repositories, logs, screenshots, or shell history.
The instructions say .mcp.json may be edited manually for project-scope removal, but do not explicitly warn that this file is repository-scoped and may be committed, affecting teammates and CI/project behavior. In this skill's context, that omission matters because project-scope MCP settings are intended for team sharing, so changes can silently alter trusted tooling configuration across the repository.
The example uses npx my-mcp-server without pinning a specific version, which can cause different code to be fetched and executed over time. In an MCP configuration context, this is more dangerous than a generic example because users may copy the command directly into persistent agent/server setup, creating a supply-chain execution risk.
No suspicious patterns detected.