Performs a structured security audit of an MCP server by reviewing its source code for credential handling, data exposure risks, permission scope, transport security, code quality, and documentation. Scores each dimension, checks for common vulnerabilities (hardcoded secrets, eval injection, path traversal), and produces a review report with an approve/conditional/reject recommendation.
Evaluate an MCP server's security posture: credential handling, data exposure, permission scope, and transport security.
Integrations: GitHub
Ask the user for:
Clone or read the MCP server repository and evaluate:
Credential Handling:
.env.example or documentation for required credentials?Data Exposure:
Permission Scope:
Transport Security:
Rate each dimension from 1 (critical risk) to 5 (excellent):
| Dimension | Score | Findings |
|---|---|---|
| Credential Handling | X/5 | ... |
| Data Exposure | X/5 | ... |
| Permission Scope | X/5 | ... |
| Transport Security | X/5 | ... |
| Code Quality | X/5 | ... |
| Documentation | X/5 | ... |
Overall Risk Level:
Specifically look for:
eval() or dynamic code execution with user inputnpm audit or equivalent)Create a structured report with:
Deliver: