mcp server security audit

The problem

MCP servers often have dangerous drift between tool descriptions and their actual handler code. Developers risk shipping RCE vulnerabilities through unsanitized inputs or leaking tenant data due to confused-deputy patterns in multi-client environments.

What it does

• Performs side-by-side audits of tool docstrings against handler implementations to detect functional drift.
• Traces caller-supplied arguments to identify injection surfaces in shell commands, SQL queries, and file paths.
• Detects confused-deputy vulnerabilities in multi-tenant servers by verifying if authorization checks rely on verified identities or unvalidated tool arguments.
• Identifies over-broad scope declarations and omnibus permissions that violate the principle of least privilege.
• Audits stateful servers for session-handle hijacking risks and shared-mutable-state leaks across concurrent connections.

Frameworks & tools

Model Context Protocol (MCP), OAuth 2.0 (RFC 8707), OWASP MCP Top 10, CVE-2026-54052, CVE-2026-0755, CVE-2026-25536.

Why this beats prompting it yourself

Generic security prompts miss the specific architectural failures unique to the MCP specification, like token passthrough and state-handle binding. This skill enforces a strict multi-step workflow grounded in recent real-world CVEs and primary-source specification requirements.

Use cases

• Reviewing a new MCP server handler for injection risks before its first release.
• Auditing a multi-tenant MCP gateway to ensure tenant isolation isn't bypassable via tool parameters.
• Hardening an existing server by narrowing requested scopes to match actual tool requirements.
• Preparing a formal pre-ship security checklist for third-party review or internal compliance.

Known limitations

Static source review only. It cannot perform dynamic testing against a running server or audit external gateway configurations, environment variables, or CORS policies.