# MCP Security Audit

> Audit .mcp.json, not security-review

**Subcategory:** GitHub  
**License:** MIT  
**Source:** https://github.com/github/awesome-copilot/blob/main/skills/mcp-security-audit/SKILL.md

---

## When it is useful

Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: reviewing .mcp.json files for security risks; checking MCP server args for hardcoded secrets or shell injection patterns; validating that MCP servers use pinned versions (not @latest); detecting unpinned dependencies in MCP server configurations; auditing which MCP servers a project registers and whether they're on an approved list; checking for environment variable usage vs. hardcoded credentials in MCP configs; any request like "is my MCP config secure?", "audit my MCP servers", or "check .mcp.json".

## The Catch

Audits .mcp.json for secrets, shell injection, unpinned @latest. Config-only — not security-review.