Mcp safety review
Skill Arnie016/codex-prompt-templates/skills/mcp-safety-review
Color-coded Codex prompt templates and Agent Skills for plugin-orchestrated AI coding workflows, MCP safety, repo intelligence, and automation.
npx -y skills add Arnie016/codex-prompt-templates --skill mcp-safety-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Review MCP servers, agent tools, install scripts, or fresh GitHub repos for security and trust risk. Use when tools request shell/filesystem/network access, credentials, browser/session control, messaging accounts, package installs, or destructive write permissions. Skip pure CI/conformance harness design after trust is established; use `$auto-skill-build-mcp-conformance-harness`.
SKILL.md
2.1 KB, as published. Nobody here has run it
MCP Safety Review
Goal: decide whether a server/tool should be installed, sandboxed, modified, or rejected.
Review Phases
- Source: repo age, maintainer, license, release artifacts, install path.
- Runtime: language, dependencies, postinstall hooks, Docker privileges, shell execution.
- Data: files read, secrets touched, remote endpoints, telemetry.
- Tools: classify every MCP tool by read/write/destructive/account-control capability.
- Auth: API keys, OAuth, token storage, tenant boundaries, local-only claims.
- Blast radius: what the tool can change without human confirmation.
Severity
high: credential exposure, destructive actions without confirmation, account takeover path, arbitrary command execution from untrusted input.medium: broad permissions, unclear auth boundary, unpinned remote code, weak logging of sensitive data.low: missing docs, weak error handling, optional hardening.info: posture notes without a concrete abuse path.
Output
# Safety Review
Verdict:
Severity:
Confidence:
Why it matters:
Evidence:
Required mitigations:
Install decision:
Hard rule: do not run raw binaries, zips, curl-piped scripts, or package installers from a fresh repo until this review is complete.
Pair With
$auto-skill-safety-mcp-secret-guardwhen configs, logs, or examples may contain credentials.$auto-skill-build-mcp-conformance-harnessafter the server is trusted and the user needs repeatable CI/release gates.
Validation
- Every exposed tool is classified by read/write/destructive/account-control capability.
- Install/run decision states what was not executed.
- Required mitigations are concrete enough to apply before trust is expanded.