test

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:53 AM UTC
• Version: 2.0.0

Overview

This is a legitimate MCP-server building guide, but its evaluator and examples can expose sensitive MCP data or unauthenticated tool endpoints without enough built-in safeguards.

Install only if you will run it in a controlled development environment. Do not evaluate production-connected MCP servers unless you are comfortable sending tool outputs to Anthropic, and harden any generated HTTP MCP server with authentication, loopback or TLS-safe binding, origin/host checks, rate limits, and least-privilege upstream credentials.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/evaluation.py:117

Finding

Unredacted MCP Tool Results Are Transmitted to an External Model API

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: reference/node_mcp_server.md:727

Finding

Copyable Streamable HTTP Server Exposes MCP Tools Without Authentication

Content

View full analysis

{ const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true }); res.on('close', () => transport.close()); await server.connect(transport); await transport.handleRequest(req, res, req.body); }); const port = parseInt(process.env.PORT || '3000'); app.listen(port, () => { console.error(`MCP server running on http://localhost:${port}/mcp`); }); ``` A second equivalent example appears at `reference/node_mcp_server.md:830-843`. ### Technical Analysis The recommended implementation accepts arbitrary requests at `/mcp` without authenticating the caller or authorizing individual tool operations. The server checks for an upstream `EXAMPLE_API_KEY`, but that only supplies credentials used by the server; it does not authenticate clients connecting to the MCP endpoint. Calling `app.listen(port)` without an explicit host can expose the service on network-accessible interfaces. The example also omits Origin and Host validation, DNS-rebinding protection, rate limiting, and transport-level access controls. These omissions conflict with the security guidance elsewhere in the project, which recommends binding local services to `127.0.0.1` and validating origins. Because this is a reference implementation rather than a server executed directly by this repository, exploitation requires a user to copy or generate a server from the example. ### Attack Path 1. A developer copies the documented HTTP server implementation. 2. The developer configures an API key that grants the server access to an external service. 3. The process starts with `app.listen(port)` and becomes reachable by another local or network user. 4. An attacker sends ...[truncated 927 chars]

Remediation

View remediation

{ console.error(`MCP server running on http://127.0.0.1:${port}/mcp`); }); ``` 2. Require client authentication using OAuth 2.1 or scoped bearer tokens. 3. Validate token issuer, audience, expiration, and intended MCP server. 4. Enforce authorization separately for each tool rather than treating authentication as universal permission. 5. Validate `Origin` and `Host` headers and enable DNS-rebinding protection. 6. Reject unexpected content types and impose request-body limits. 7. Add rate limiting, audit logging, and abuse monitoring. 8. Use TLS when the endpoint is accessible outside loopback. 9. Use narrowly scoped upstream API credentials and separate read-only credentials from write-capable credentials. 10. Update both HTTP examples and the quality checklist so authentication and safe binding are mandatory rather than optional. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: reference/python_mcp_server.md:539

Finding

Document Resource Example Allows Filesystem Path Traversal

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Open-Ended Dependency Constraints Permit Unreviewed Package Updates

Content

View full analysis

=0.39.0 mcp>=1.1.0 ``` The installation guide executes these constraints with: ```bash pip install -r scripts/requirements.txt ``` It also recommends an entirely unversioned alternative at `reference/evaluation.md:392`: ```bash pip install anthropic mcp ``` ### Technical Analysis The requirements file specifies only lower version bounds. A future installation can therefore resolve to any later release accepted by pip, including releases that were never reviewed with this project. The manual installation alternative removes even the lower bounds. Python packages and their transitive dependencies can execute code during installation, import, and runtime. No lockfile, package hashes, or reproducible resolution metadata is provided. This increases exposure to compromised maintainer accounts, malicious future releases, dependency confusion in misconfigured package indexes, and unexpected breaking security changes. The audit did not find evidence that the currently named packages are malicious. The finding concerns unsafe dependency resolution and supply-chain controls. ### Attack Path 1. A future package release or one of its transitive dependencies is compromised. 2. A user follows the documented installation command. 3. Because the constraints are open-ended, pip selects the compromised release. 4. Package installation, import, or evaluator execution runs attacker-controlled code. 5. That code executes with the installing user's privileges and may access the Anthropic API key, MCP credentials, project files, or network resources. ### Impact Assessment Successful supply-chain compromise can result in arbitrary code execution under the account installing or running the evaluator. This may expose `ANTHROPIC_API_KE ...[truncated 328 chars]

Remediation

View remediation

mcp== ``` 2. Generate and commit a lockfile that includes all transitive dependencies. 3. Use package hashes and install with `pip --require-hashes`. 4. Remove the unversioned `pip install anthropic mcp` alternative from the guide. 5. Configure trusted package indexes explicitly and disable unintended extra indexes. 6. Run dependency vulnerability and provenance checks in continuous integration. 7. Review updates before changing pinned versions. 8. Install dependencies inside an isolated virtual environment or container with minimal filesystem and credential access. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill is a guide for creating MCP servers—documentation/tutorial content for building integrations. The supplied code does not provide guidance or server-building utilities. Instead, it implements an automated evaluation framework for existing MCP servers. Its primary purpose is materially different: testing and benchmarking MCP servers via Claude-driven tool use, with support for transports, headers/env vars, XML task parsing, scoring, and report generation. These are substantial functional capabilities not reflected in the declared purpose, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

- [⚡ TypeScript Guide](./reference/node_mcp_server.md) - TypeScript patterns and examples

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

- [⚡ TypeScript Guide](./reference/node_mcp_server.md) - TypeScript patterns and examples

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md

- [⚡ TypeScript Guide](./reference/node_mcp_server.md) - TypeScript patterns and examples

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · reference/evaluation.md (reported line 488)May include surrounding context.

md

optional arguments:
  -h, --help            Show help message
  -t, --transport       Transport type: stdio, sse, or http (default: stdio)
  -m, --model           Claude model to use (default: claude-3-7-sonnet-20250219)
  -o, --output          Output file for report (default: print to stdout)

stdio options:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference/mcp_best_practices.md (reported line 158)May include surrounding context.

md

**OAuth 2.1**:
- Use secure OAuth 2.1 with certificates from recognized authorities
- Validate access tokens before processing requests
- Only accept tokens specifically intended for your server

**API Keys**:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs the agent to perform actions that imply MCP access and file creation/writing, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an under-specified trust boundary: a host may grant broader tools than the author intended, enabling the skill to drive sensitive capabilities during execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

Using npx @modelcontextprotocol/inspector without pinning a version causes execution of whatever package version is current at run time. This introduces a supply-chain risk: a compromised upstream release or breaking update could execute unexpected code or alter testing behavior when users follow the guide.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · reference/evaluation.md (reported line 205)May include surrounding context.

md

After understanding the API and tools, USE the MCP server tools:
- Inspect content using READ-ONLY and NON-DESTRUCTIVE operations ONLY
- Goal: identify specific content (e.g., users, channels, messages, projects, tasks) for creating realistic questions
- Should NOT call any tools that modify state
- Will NOT read the code of the MCP server implementation itself
- Parallelize this step with individual sub-agents pursuing independent explorations
- Ensure each subagent is only performing READ-ONLY, NON-DESTRUCTIVE, and IDEMPOTENT operations

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide presents a streamable HTTP MCP server example that accepts requests on /mcp without any authentication, authorization, or explicit warning that the endpoint is exposed. In the context of an MCP server builder skill, this is dangerous because developers may copy the example verbatim and deploy remote tool execution endpoints that arbitrary clients can invoke.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/node_mcp_server.md (reported line 601)May include surrounding context.

md

mcp = FastMCP("example_mcp")

# Constants
API_BASE_URL = "https://api.example.com/v1"

# Enums
class ResponseFormat(str, Enum):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/python_mcp_server.md (reported line 353)May include surrounding context.

md

mcp = FastMCP("example_mcp")

# Constants
API_BASE_URL = "https://api.example.com/v1"

# Enums
class ResponseFormat(str, Enum):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The evaluation prompt explicitly instructs the model to disclose the inputs and outputs of every tool invocation in its

. Since MCP tools often handle secrets, tokens, personal data, internal documents, or privileged API responses, this design can cause sensitive data to be copied into model output and then persisted in the generated report. In an evaluation harness, this is especially risky because logs and reports are commonly shared, stored, or inspected outside the original trust boundary.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This is a true data-exposure issue: the system prompt requires the model to reveal full tool inputs and outputs, and the harness then extracts and stores those summaries/feedback in the final report. If the evaluated MCP server accesses external services, the tool I/O may include API keys, authentication headers, customer records, proprietary content, or other confidential material, turning routine evaluation into an exfiltration channel. The skill context increases the danger because this code is specifically meant to test MCP servers that bridge LLMs to external systems, where sensitive data exposure is a realistic and common failure mode.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document explicitly instructs readers to avoid any and use proper types or unknown, but earlier example code uses makeApiRequest<any> and user: any, and later the shared utility signature uses data?: any and params?: any. This is an active contradiction between the guide's stated intent and its demonstrated implementation patterns, not merely an omission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide includes a resource example that reads a local file path derived from user-controlled input (name) without any warning or safeguards. In an MCP server-building guide, this can normalize unsafe patterns and lead implementers to create path traversal or unintended local file disclosure primitives.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified with a lower bound only (anthropic>=0.39.0), which permits installation of any newer release and makes builds non-reproducible. This increases supply-chain risk and makes it harder to ensure deployment avoids vulnerable or breaking versions, especially relevant for an MCP-building skill that may be reused to create networked integrations.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

anthropic>=0.39.0
mcp>=1.1.0

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The manifest references anthropic without pinning a specific release, and the package has known advisories. That means consumers may install an affected version without realizing it, and since this package can interact with local files and external APIs, vulnerable versions may expose filesystem or sandbox-related risk depending on usage.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency mcp>=1.1.0 is unpinned, so installations may resolve to different versions over time, including versions with security regressions or incompatible behavior. Because this skill is specifically for building MCP servers that expose external-service tooling, dependency uncertainty is more concerning than in a purely local utility.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

anthropic>=0.39.0
mcp>=1.1.0

Unverifiable Dependency: mcp has 12 known advisory(ies) (CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2026-52870 (MCP Python SDK: Experimental task handlers allow any client to access and cancel) +9 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The mcp package has multiple known advisories, but the requirements file does not constrain it to a safe version. In the context of a skill for building MCP servers, this is more dangerous because vulnerable SDK behavior could directly affect exposed tools, request handling, or server-side protections such as validation and network safety controls.

Content

No source excerpt is available for this finding.