Secure mcp server
15 production Agent Skills — MCP, LangGraph, RAG, security, Cursor SDK. MIT licensed.
npx -y skills add m00kk/agent-skills-playbook --skill secure-mcp-serverAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Hardens MCP servers with OAuth, scoped tools, input validation, and safe defaults. Use when securing MCP, adding authentication, preventing tool abuse, or reviewing MCP security before production.
SKILL.md
1.8 KB, 381 tokens by cl100k_base, as published. Nobody here has run it
Secure MCP Server
Threat model (agent context)
| Risk | Mitigation |
|---|---|
| Prompt injection → tool abuse | Scoped tools, human approval for writes |
| Over-broad tools | Split read vs write tools; deny by default |
| Credential exfil | Never return env; mask tokens in logs |
| SSRF via URL tools | Allowlist hosts; block private IP ranges |
Workflow
- Inventory tools — classify: read / write / admin / network
- Apply least privilege — remove unused tools; narrow parameters
- Auth layer — remote servers: OAuth 2.1 + PKCE; local: OS user boundary only
- Validation — max length, enum fields, regex for IDs
- Audit — log tool name + args hash (not secrets)
OAuth pattern (remote HTTP)
- Register client with redirect URI
- Store refresh tokens server-side only
- Pass short-lived access tokens per request scope
- Document required scopes in README
Destructive operations
Require one of:
- Separate
*_confirmtool that needs explicitconfirmed: true - Client-side approval (Cursor user confirms)
- Idempotency keys for retried writes
Review commands
Run from repo root (adjust paths):
# Find dangerous patterns
rg -n 'subprocess|os\.system|eval\(|exec\(|shell=True' --glob '!node_modules'
rg -n 'password|secret|api_key|token' --glob '!.env.example'
Pass criteria
- No tool returns full filesystem or env
- Network tools use allowlists
- Write tools documented and gated
- Security section in README
See build-mcp-server for implementation scaffolding.