This skill as a file
$7 one payment, yours forever
- Download right after checkout, keep it for good
- Paste it into ChatGPT, Claude, Gemini or any AI chat, free plans included
- 30-day money-back guarantee
MCP Security Reviewer
$7.00
Ir a la información del producto
MCP Security Reviewer
MCP Security Reviewer checks an MCP server or client config before you connect it to Claude.
$7.00
este skill
un solo pago
tuyo para siempre
Paquete skill completo descarga instantáneamcp-security-reviewer.md
Unlimited
Or get every skill, not just this one
$9/mes
Este y 2,500+ más, dentro de tu IA
Este skill$7
Unlimited$9/mes
Paga una vez, tuyo para siempreDescarga instantáneaGarantía de reembolso de 30 días
As featured onProduct HuntFazierKittyLaunch
Secure checkout by Shopify
Trademarks of their respective owners. KissMySkills is not affiliated with or endorsed by them.
O todos los skills, dentro de tu IA.
¿Dudas antes de comprar? Responde una persona, normalmente el mismo día: hello@kissmyskills.com
// the file itself
Read it before you buy it.
The first lines of the file your AI will read, exactly as delivered. Nothing rewritten for the page.
Usa el nombre
Con el archivo cargado, hablale por su nombre: «Serge, mira esta pagina.» Para eso esta el nombre. Asi varios skills no se mezclan en un mismo chat.
Con el archivo cargado, hablale por su nombre: «Serge, mira esta pagina.» Para eso esta el nombre. Asi varios skills no se mezclan en un mismo chat.
// el skill con el que funciona tu IA
You are an application security reviewer for MCP servers and client configs who never runs untrusted code. You have been activated to find prompt injection, over-broad scopes and token leaks and to write the fixes.
// two ways to get it
Buy this file, or open the whole library.
Every skill, prompt and agent, inside your chat
$9/mo cancel anytime, or $59 a year
- All 2,500+ files in the library, loaded the moment you ask
- Nothing to download or paste: connect once in Claude, ChatGPT, Claude Code or Cursor
- Works on every Claude plan, free included · 30-day money-back guarantee on the first charge
Subscribers can still buy single files and keep them after they cancel.
What you're actually buying
MCP Security Reviewer checks an MCP server or client config before you connect it to Claude. Give it the server code, the tool definitions and your claude_desktop_config.json or connector settings, and it returns findings by severity with the file and line, the evidence, a short exploit scenario and the fixed code.
Built for developers shipping MCP servers and teams deciding which third-party servers to allow. It looks for prompt injection through tool results and descriptions, tool poisoning and silent description changes, over-broad scopes, token passthrough, tokens in logs or URLs, missing audience checks, SSRF, command injection and path traversal, unauthenticated remote endpoints, local servers exposed on 0.0.0.0, secrets in config files and unpinned packages. It is a static review and never runs an untrusted server; it reviews security rather than designing tools.
Finds the holes an attacker would use before an MCP server gets access to your files, inbox or production API.
Compatible with: MCP TypeScript and Python servers, Cloudflare Workers remote MCP, Claude Desktop and Claude Code configs, Claude.ai connectors and other MCP clients.
- What is MCP tool poisoning? Hidden instructions in a tool description or result that steer the model; the reviewer flags them with the exact text.
- Does it check OAuth? Yes - token audience, scopes, passthrough, storage and redirect handling.
- Can it review a server I did not write? Yes - paste the code or config; it never executes it.
- What do I get at the end? A findings table, a scope matrix per tool, a config review and a fix order.
// cómo instalar
En menos de 2 minutos
Cuatro pasos. Cualquier chat de AI.
- 01Descarga el archivo
Después del pago, el enlace de descarga llegará a tu bandeja de entrada. Guarda el archivo en cualquier lugar de tu dispositivo.
- 02Abre tu chat de AI
Claude, ChatGPT, Gemini, Grok o Copilot: el que ya uses.
- 03Pega el contenido del archivo
Introdúcelo en el prompt del sistema, en las instrucciones del proyecto o en el campo de instrucciones personalizadas.
- 04Empieza a trabajar
Tu AI ahora está configurada como especialista. Pregúntale cualquier cosa dentro de su ámbito.
No se requieren conocimientos técnicos.
Con Unlimited no hay nada que descargar. Conecta tu IA una vez y pide cualquier skill por su nombre.
Guía de configuración → Unlimited · $4.92/mes en el plan anual →
// faq
Preguntas sobre este producto
What does MCP Security Reviewer do?+
It statically reviews MCP server code and client configs and returns findings by severity: prompt injection and tool poisoning, over-broad scopes, token passthrough and leaks, SSRF, command injection, path traversal, missing auth and secrets in config, each with location, evidence, an exploit scenario and a code fix.
What are the main MCP security risks?+
Untrusted text in tool results or descriptions that steers the model, tools with more access than the task needs, tokens passed through or logged, remote endpoints without proper OAuth, local HTTP servers open to the network, and install commands that pull unpinned packages.
Does it check MCP OAuth and token handling?+
Yes. It checks that tokens are issued for your server and validated for audience, that scopes match each tool, that upstream tokens are never passed through, and that tokens never appear in logs, URLs or config files.
Is it the same as an MCP builder or tool-design skill?+
No. Builders write and deploy servers and tool-design skills tune schemas. This skill attacks the design on paper and tells you what to fix before anyone connects it.