MCP Security Audit

Audit .mcp.json, not security-review

GitHub · MIT

When

Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: reviewing .mcp.json files for security risks; checking MCP server args for hardcoded secrets or shell injection patterns; validating that MCP servers use pinned versions (not @latest); detecting unpinned dependencies in MCP server configurations; auditing which MCP servers a project registers and whether they're on an approved list; checking for environment variable usage vs. hardcoded credentials in MCP configs; any request like "is my MCP config secure?", "audit my MCP servers", or "check .mcp.json".

The Catch

Audits .mcp.json for secrets, shell injection, unpinned @latest. Config-only — not security-review.

Embed

[![Reviewed on Stack Gems](https://stackgems.com/badge/skill/mcp-security-audit.svg)](https://stackgems.com/skills/mcp-security-audit)