MCP Security Reviewer: Audit MCP Servers

Name: MCP Security Reviewer
Brand: KissMySkills
Price: 7.0 USD
Availability: InStock

MCP Security Reviewer

MCP Security Reviewer checks an MCP server or client config before you connect it to Claude.

$7.00 questo skill un solo pagamento tuo per sempre

Pacchetto skill completo download immediatomcp-security-reviewer.md

Unlimited

Get this and 2,500+ more with Unlimited $9/mese

Questo e altri 2,500+, dentro la tua IA

AI CRM included

Questo skill$7

Unlimited$9/mese

See Unlimited · $9/mese → or try every skill free for 7 days, no card

Paghi una volta, tuo per sempreDownload immediatoSoddisfatti o rimborsati 30 giorni

As featured onProduct Hunt Fazier KittyLaunch

Works with

Secure checkout by Shopify

Trademarks of their respective owners. KissMySkills is not affiliated with or endorsed by them.

Oppure tutti gli skill, dentro la tua IA.

0:33 · senza audio

Tutti i 2,500+ con Unlimited · $9/mese con il piano annuale →

Domande prima di comprare? Risponde una persona, di solito in giornata: hello@kissmyskills.com

// the file itself

Read it before you buy it.

The first lines of the file your AI will read, exactly as delivered. Nothing rewritten for the page.

// il skill su cui gira la tua IA

You are an application security reviewer for MCP servers and client configs who never runs untrusted code. You have been activated to find prompt injection, over-broad scopes and token leaks and to write the fixes.

servers built on @modelcontextprotocol/sdk (TypeScript) or mcp / FastMCP (Python), remote servers on Streamable HTTP, local stdio servers, and the client configs that launch them (Claude Desktop claude_desktop_config.json, Claude Code claude mcp add entries and .mcp.json, Claude.ai custom connectors). You think like an attacker who controls one of three things: content that flows into a tool result (a web page, an email, a ticket, a file), the server package itself (a malicious or later-compromised dependency), or a network position (another site in the user's browser, another tenant on the remote server). Your question for every tool is: if the model is tricked, what is the worst this tool lets it do, and who pays? You review statically. You read code, schemas, descriptions, configs, manifests and lockfiles. You never install or execute an untrusted server to "see what it does", and you tell the user to do dynamic testing only in a

223 righe · .md · download immediato

// two ways to get it

Buy this file, or open the whole library.

Buy once

This skill as a file

$7 one payment, yours forever

Download right after checkout, keep it for good
Paste it into ChatGPT, Claude, Gemini or any AI chat, free plans included
30-day money-back guarantee

Unlimited Access

Every skill, prompt and agent, inside your chat

$9/mo cancel anytime, or $59 a year

All 2,500+ files in the library, loaded the moment you ask
Nothing to download or paste: connect once in Claude, ChatGPT, Claude Code or Cursor
Works on every Claude plan, free included · 30-day money-back guarantee on the first charge

See Unlimited Access →

Subscribers can still buy single files and keep them after they cancel.

Works with

Trademarks of their respective owners. KissMySkills is not affiliated with or endorsed by them.

What you're actually buying

MCP Security Reviewer checks an MCP server or client config before you connect it to Claude. Give it the server code, the tool definitions and your claude_desktop_config.json or connector settings, and it returns findings by severity with the file and line, the evidence, a short exploit scenario and the fixed code.

Built for developers shipping MCP servers and teams deciding which third-party servers to allow. It looks for prompt injection through tool results and descriptions, tool poisoning and silent description changes, over-broad scopes, token passthrough, tokens in logs or URLs, missing audience checks, SSRF, command injection and path traversal, unauthenticated remote endpoints, local servers exposed on 0.0.0.0, secrets in config files and unpinned packages. It is a static review and never runs an untrusted server; it reviews security rather than designing tools.

Finds the holes an attacker would use before an MCP server gets access to your files, inbox or production API.

Compatible with: MCP TypeScript and Python servers, Cloudflare Workers remote MCP, Claude Desktop and Claude Code configs, Claude.ai connectors and other MCP clients.

What is MCP tool poisoning? Hidden instructions in a tool description or result that steer the model; the reviewer flags them with the exact text.
Does it check OAuth? Yes - token audience, scopes, passthrough, storage and redirect handling.
Can it review a server I did not write? Yes - paste the code or config; it never executes it.
What do I get at the end? A findings table, a scope matrix per tool, a config review and a fix order.

// come installare Meno di 2 minuti

Quattro passaggi. Qualsiasi chat AI.

01
Scarica il file
Dopo il pagamento, il link per il download arriverà nella tua casella di posta. Salva il file in qualsiasi posizione sul tuo dispositivo.
02
Apri la tua chat AI
Claude, ChatGPT, Gemini, Grok o Copilot: qualunque sia quello che usi già.
03
Incolla il contenuto del file
Inseriscilo nel prompt di sistema, nelle istruzioni del progetto o nel campo delle istruzioni personalizzate.
04
Inizia a lavorare
La tua AI è ora configurata come specialista. Chiedile qualsiasi cosa nell’ambito di sua competenza.

Non è richiesta alcuna conoscenza tecnica.

Con Unlimited non c’è niente da scaricare. Collega la tua IA una volta, poi chiedi qualsiasi skill per nome.

Guida alla configurazione → Unlimited · $4.92/mese con il piano annuale →

// faq

Domande su questo prodotto

What does MCP Security Reviewer do?+

It statically reviews MCP server code and client configs and returns findings by severity: prompt injection and tool poisoning, over-broad scopes, token passthrough and leaks, SSRF, command injection, path traversal, missing auth and secrets in config, each with location, evidence, an exploit scenario and a code fix.

What are the main MCP security risks?+

Untrusted text in tool results or descriptions that steers the model, tools with more access than the task needs, tokens passed through or logged, remote endpoints without proper OAuth, local HTTP servers open to the network, and install commands that pull unpinned packages.

Does it check MCP OAuth and token handling?+

Yes. It checks that tokens are issued for your server and validated for audience, that scopes match each tool, that upstream tokens are never passed through, and that tokens never appear in logs, URLs or config files.

Is it the same as an MCP builder or tool-design skill?+

No. Builders write and deploy servers and tool-design skills tune schemas. This skill attacks the design on paper and tells you what to fix before anyone connects it.