agentsclimarketplace

Mcp safety review

Skill Arnie016/codex-prompt-templates/skills/mcp-safety-review

Color-coded Codex prompt templates and Agent Skills for plugin-orchestrated AI coding workflows, MCP safety, repo intelligence, and automation.

Install
npx -y skills add Arnie016/codex-prompt-templates --skill mcp-safety-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Review MCP servers, agent tools, install scripts, or fresh GitHub repos for security and trust risk. Use when tools request shell/filesystem/network access, credentials, browser/session control, messaging accounts, package installs, or destructive write permissions. Skip pure CI/conformance harness design after trust is established; use `$auto-skill-build-mcp-conformance-harness`.

SKILL.md

2.1 KB, as published. Nobody here has run it

MCP Safety Review

Goal: decide whether a server/tool should be installed, sandboxed, modified, or rejected.

Review Phases

  1. Source: repo age, maintainer, license, release artifacts, install path.
  2. Runtime: language, dependencies, postinstall hooks, Docker privileges, shell execution.
  3. Data: files read, secrets touched, remote endpoints, telemetry.
  4. Tools: classify every MCP tool by read/write/destructive/account-control capability.
  5. Auth: API keys, OAuth, token storage, tenant boundaries, local-only claims.
  6. Blast radius: what the tool can change without human confirmation.

Severity

  • high: credential exposure, destructive actions without confirmation, account takeover path, arbitrary command execution from untrusted input.
  • medium: broad permissions, unclear auth boundary, unpinned remote code, weak logging of sensitive data.
  • low: missing docs, weak error handling, optional hardening.
  • info: posture notes without a concrete abuse path.

Output

# Safety Review
Verdict:
Severity:
Confidence:
Why it matters:
Evidence:
Required mitigations:
Install decision:

Hard rule: do not run raw binaries, zips, curl-piped scripts, or package installers from a fresh repo until this review is complete.

Pair With

  • $auto-skill-safety-mcp-secret-guard when configs, logs, or examples may contain credentials.
  • $auto-skill-build-mcp-conformance-harness after the server is trusted and the user needs repeatable CI/release gates.

Validation

  • Every exposed tool is classified by read/write/destructive/account-control capability.
  • Install/run decision states what was not executed.
  • Required mitigations are concrete enough to apply before trust is expanded.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.