mcp-implementation-security-review
Installation
SKILL.md
MCP Implementation Security Review
Review the source code of an MCP server or client implementation for exploitable vulnerabilities. This is a code-level review — it inspects how a server or client is built, not how it is configured or governed. Every finding must be backed by a file/line citation so the report is directly actionable.
When to Use
- A team is shipping or accepting a custom MCP server/client implementation (not just an off-the-shelf binary)
- Code review of a PR that adds or modifies MCP transport, auth, or tool-dispatch logic
- Before trusting a third-party MCP server whose source is available for inspection
- Auditing an internal MCP SDK wrapper for unsafe defaults