This skill as a file
$7 one payment, yours forever
- Download right after checkout, keep it for good
- Paste it into ChatGPT, Claude, Gemini or any AI chat, free plans included
- 30-day money-back guarantee
MCP Security Reviewer
$7.00
跳至產品資訊
MCP Security Reviewer
MCP Security Reviewer checks an MCP server or client config before you connect it to Claude.
$7.00
this skill
one payment
yours forever
Complete skill package instant downloadmcp-security-reviewer.md
Unlimited
Get this and 2,500+ more with Unlimited
$9/mo
This one plus 2,500+ more, inside your AI
AI CRM includedThis skill$7
Unlimited$9/mo
Pay once, keep foreverInstant download30-day money-back guarantee
As featured onProduct HuntFazierKittyLaunch
Secure checkout by Shopify
Trademarks of their respective owners. KissMySkills is not affiliated with or endorsed by them.
Or have every skill inside your AI.
Questions before you buy? A person answers, usually the same day: hello@kissmyskills.com
// the file itself
Read it before you buy it.
The first lines of the file your AI will read, exactly as delivered. Nothing rewritten for the page.
Use the name
Once the file is loaded, talk to it by name: “Serge, check this page.” That is what the name is for. It also keeps several skills apart in one chat.
Once the file is loaded, talk to it by name: “Serge, check this page.” That is what the name is for. It also keeps several skills apart in one chat.
// the skill your AI runs on
You are an application security reviewer for MCP servers and client configs who never runs untrusted code. You have been activated to find prompt injection, over-broad scopes and token leaks and to write the fixes.
// two ways to get it
Buy this file, or open the whole library.
Every skill, prompt and agent, inside your chat
$9/mo cancel anytime, or $59 a year
- All 2,500+ files in the library, loaded the moment you ask
- Nothing to download or paste: connect once in Claude, ChatGPT, Claude Code or Cursor
- Works on every Claude plan, free included · 30-day money-back guarantee on the first charge
Subscribers can still buy single files and keep them after they cancel.
What you're actually buying
MCP Security Reviewer checks an MCP server or client config before you connect it to Claude. Give it the server code, the tool definitions and your claude_desktop_config.json or connector settings, and it returns findings by severity with the file and line, the evidence, a short exploit scenario and the fixed code.
Built for developers shipping MCP servers and teams deciding which third-party servers to allow. It looks for prompt injection through tool results and descriptions, tool poisoning and silent description changes, over-broad scopes, token passthrough, tokens in logs or URLs, missing audience checks, SSRF, command injection and path traversal, unauthenticated remote endpoints, local servers exposed on 0.0.0.0, secrets in config files and unpinned packages. It is a static review and never runs an untrusted server; it reviews security rather than designing tools.
Finds the holes an attacker would use before an MCP server gets access to your files, inbox or production API.
Compatible with: MCP TypeScript and Python servers, Cloudflare Workers remote MCP, Claude Desktop and Claude Code configs, Claude.ai connectors and other MCP clients.
- What is MCP tool poisoning? Hidden instructions in a tool description or result that steer the model; the reviewer flags them with the exact text.
- Does it check OAuth? Yes - token audience, scopes, passthrough, storage and redirect handling.
- Can it review a server I did not write? Yes - paste the code or config; it never executes it.
- What do I get at the end? A findings table, a scope matrix per tool, a config review and a fix order.
// how to install
不到 2 分鐘
四個步驟。任何 AI 聊天。
- 01下載檔案
結帳後，下載連結會寄到您的收件匣。將檔案儲存至裝置上的任意位置。
- 02開啟你的 AI 聊天功能
Claude、ChatGPT、Gemini、Grok 或 Copilot - 無論你目前使用哪一個。
- 03貼上檔案內容
將其放入系統 prompt、專案指示或自訂指示欄位中。
- 04開始工作
您的 AI 現已設定為專業助手。您可以詢問它任何與其專業領域相關的問題。
不需要技術知識。不需訂閱。一次付費，永久使用。.
With Unlimited there is nothing to download. Connect your AI once, then ask for any skill by name.
// faq
關於此產品的問題
What does MCP Security Reviewer do?+
It statically reviews MCP server code and client configs and returns findings by severity: prompt injection and tool poisoning, over-broad scopes, token passthrough and leaks, SSRF, command injection, path traversal, missing auth and secrets in config, each with location, evidence, an exploit scenario and a code fix.
What are the main MCP security risks?+
Untrusted text in tool results or descriptions that steers the model, tools with more access than the task needs, tokens passed through or logged, remote endpoints without proper OAuth, local HTTP servers open to the network, and install commands that pull unpinned packages.
Does it check MCP OAuth and token handling?+
Yes. It checks that tokens are issued for your server and validated for audience, that scopes match each tool, that upstream tokens are never passed through, and that tokens never appear in logs, URLs or config files.
Is it the same as an MCP builder or tool-design skill?+
No. Builders write and deploy servers and tool-design skills tune schemas. This skill attacks the design on paper and tells you what to fix before anyone connects it.