ScopeBlind protect-mcp

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user may run a newer or different package version than expected, which matters because the package is intended to sit in front of MCP tool calls.

Why it was flagged

The skill instructs users to install an unpinned npm package globally. This is disclosed and central to the tool’s purpose, but @latest means the installed code can change over time.

Skill content

install: |
    npm install -g protect-mcp@latest

Recommendation

Verify the npm package publisher and version, prefer a pinned version, and review release notes before installing or updating.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If invoked incautiously, the agent could run local commands or read/write policy-related files while setting up the gateway.

Why it was flagged

The skill declares local shell and file access so the agent can run the gateway and work with policy files. This aligns with the MCP proxy purpose, but it is still broad local authority.

Skill content

allowed-tools:
    - Bash
    - Read
    - Write

Recommendation

Use the commands only when you intend to configure the gateway, review policies before enforce mode, and avoid granting broader file access than needed.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Audit logs or signed receipts could contain sensitive information from tool usage and may persist after the session.

Why it was flagged

The gateway’s audit behavior is explicit, but “logs everything” may include sensitive MCP tool-call details depending on the wrapped server and tool arguments.

Skill content

Shadow mode logs everything without blocking. Enforce mode applies policy.

Recommendation

Check where logs and receipts are stored, limit what tool-call data is captured when possible, protect signing keys, and avoid wrapping sensitive servers without a retention plan.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

The proxy can observe and influence communication between the agent and wrapped MCP tools.

Why it was flagged

The skill is explicitly an intermediary for MCP communications. That is the core purpose, but users should understand the trust boundary introduced by placing a proxy between an agent and MCP server.

Skill content

Wraps any MCP server as a transparent stdio proxy with per-tool security policies and cryptographic audit trail.

Recommendation

Use it only with MCP servers and policies you trust, and confirm that the proxy configuration matches the intended server and tool scope.