subprocess.getoutput(f"git log {ref}") in a tool lets any page, issue or file the model reads run commands on your machine, and a hidden IMPORTANT block in a tool description can tell the model to read your SSH keys and keep quiet about it. This skill finds those and eleven other MCP server mistakes before you publish, install or connect a server, and tells you how to fix each one.

Your agent runs a scanner on the server's source: Python with the mcp SDK (FastMCP, MCPServer, the low-level Server) or the fastmcp package, and TypeScript or JavaScript with @modelcontextprotocol/sdk, the @modelcontextprotocol/server packages or fastmcp. It skips comments, tells strings from code, follows tool arguments from the handler's parameters through variables and into helper functions in the same file, and accepts the usual guards (path root checks, host allow lists, shlex.quote, schema validation, bearer authentication). It never runs, imports or connects to the server. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• M01: tool arguments or other values that are not fixed in shell commands (subprocess with the shell option, also under import aliases, os.popen and system, getoutput, sh -c lists, Node exec/execSync however it is imported, spawn with a shell option); shlex.quote values and typed int parameters are fine
• M02: eval, exec, new Function or node:vm run on values that are not fixed
• M03: API keys, tokens and passwords written in the server code
• M04: hidden instructions to the model in tool, prompt and parameter descriptions or server instructions (IMPORTANT tag blocks, Unicode tag or bidi override characters, secrecy toward the user combined with reading SSH keys or mcp.json, or two weaker signs together); ordinary notes, placeholders and non-English text are not flagged

REVIEW (check before release)

• M11: tool arguments used as file paths with no check that they stay inside an allowed folder
• M12: URLs or hosts from tool arguments fetched with no allow list (SSRF)
• M13: HTTP transports listening on all interfaces with no authentication
• M14: HTTP transports with no Host or Origin check (DNS rebinding)
• M15: print, console.log and other stdout writes in stdio servers
• M16: low-level tools/call handlers that read arguments nothing validates
• M17: tools that return the environment or secret environment variables to the model
• M18: SQL built from strings with values that are not fixed
• M19: one weaker sign of hidden instructions in tool text (secrecy toward the user, an order to disregard earlier instructions, a system tag pair, a lone IMPORTANT tag, shadowing another tool, zero-width characters)

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example server (Python and TypeScript), and the real report the scanner produces on the risky one

Limits

It reads each file on its own: tool arguments are followed only within one file, a few calls deep. MCP client configuration files, dependency vulnerabilities, the installed SDK version, a reverse proxy in front of the server and run-time behaviour are not checked; Go, Java, Kotlin, C# and Rust SDKs are not read. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 18 files: SKILL.md, the scanner in scripts/ (9 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (6 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.