mcp-server-security

MCP security is not ordinary API security: the caller is a manipulable LLM, the server's own metadata is executable-ish content in someone else's context, and agents retry, parallelize, and obey instructions found in data. This skill encodes the attack classes documented in real disclosures and the defenses that counter them. Auth mechanics (OAuth, audiences, tokens) live in mcp-server-auth; this skill assumes identity exists and hardens everything else.

When NOT to use

• Implementing OAuth/discovery/token validation → mcp-server-auth.
• Building the server / transport wiring → mcp-server-implementation (the Origin/localhost/session-ID floors are set there; this skill explains the attacks behind them).
• Generic web/infra scanning, container CVEs, non-MCP pentesting.

Workflow