SkillCurated by metahubEval warningsprompts

mcp-security-reviewer

Name: mcp-security-reviewer
Author: oxbshw

Use before connecting a new MCP server to your agent — produces a structured security review covering source, permissions, tools, network, and approvals.

pinned to #7f8ee3cupdated 2 months ago

7/11Verified publisherCurated by MetaHubActively maintainedLicensedDocumentedStructuredClean repo

Ask your AI client: “install skills/mcp-security-reviewer”.

Requires the metahub MCP server installed in your client. Set up MCP.

mh install skills/mcp-security-reviewer

metahub onboarded this repo on the author's behalf.

If you own github.com/oxbshw/LLM-Agents-Ecosystem-Handbook on GitHub, claim the listing to take over publishing. Your claim preserves the existing eval history and badges; only the curator label is replaced with verified-publisher on your next publish.

Claim this repo

Stars

533

Last commit

2 months ago

7f8ee3c

Latest release

published

2 months ago

#ai
#ai-agent
#ai-agents
#fine-tuning
#finetuning-llms
#freamework
#llm
#llmops
#local-development
#mcp-server
#memory
#rag
#rag-chatbot
#voice-agent

Evaluation report

WarningsView full report

Automated checks the publisher passed at publish time — structure, docs, safety, and whether the artifact behaves as claimed.7f8ee3c· 2 months ago

Documentation

4 passed1 warning

README has usage / example sectionswarn
README has no Usage / Example / Quick start / Installation heading at any level
Add a `# Usage`, `## Quick start`, or similar section so end users can copy/paste a working invocation. Code blocks alone work too if there are several.
Description quality
23 words · 153 chars — "Use before connecting a new MCP server to your agent — produces a structured sec…"
README is present and substantial
19,199 chars · 20 sections · 2 code blocks
Tags / topics declared
14 total — ai, ai-agent, ai-agents, fine-tuning, finetuning-llms, freamework (+8)
Homepage / docs URL declared
no homepage declared (registry will use the repo URL) — info-only, not blocking

Release history

releasecurrent7f8ee3cwarn2 months ago

View on GitHub

When to use

A new MCP server is being added to an agent
An MCP server version is being bumped
An incident triggered a re-review

Inputs

Name	Type	Required	Notes
`repo_url`	string	yes	the MCP server's source
`version`	string	yes	tag or commit SHA being adopted
`intended_use`	string	yes	one paragraph: what we'll let it do

Workflow

Source review: clone at the pinned version; check for unexpected files / scripts
Capabilities: list every tool and resource exposed; map to risk levels (references/mcp-risk-matrix.md)
Network: identify outbound endpoints; document and assess each
Permissions: minimum required scopes / tokens; document over-permissions
Output handling: confirm the agent treats tool output as untrusted (sanitization, no execution)
Approvals: define which tools require human approval
Produce filled MCP_SERVER.md in mcp/<server>.md