{ "file": "sample_mcp_server.py", "tools_found": 4, "summary": {"high": 1, "medium": 5, "low": 1, "info": 1}, "tools": [ { "name": "safe_echo", "findings": [] }, { "name": "run_cmd", "findings": [ {"category": "ambiguous-description", "severity": "low", "message": "docstring is very short (4 chars) — risk of LLM misuse"}, {"category": "over-broad-param", "severity": "medium", "message": "parameter `cmd`: command-like parameter typed as bare `str`"}, {"category": "shell-exec", "severity": "high", "message": "calls `subprocess.run`"} ] }, { "name": "read_anything", "findings": [ {"category": "ambiguous-description", "severity": "medium", "message": "tool has no docstring — the LLM cannot reason about when to use it"}, {"category": "over-broad-param", "severity": "medium", "message": "parameter `path`: path-like parameter typed as bare `str` (no allow-list)"} ] }, { "name": "write_log", "findings": [ {"category": "over-broad-param", "severity": "medium", "message": "parameter `path`: path-like parameter typed as bare `str` (no allow-list)"}, {"category": "fs-write", "severity": "medium", "message": "opens file for writing (mode='a')"} ] } ], "file_level_findings": [ {"category": "secret-in-env", "severity": "info", "message": "reads secret from env `SECRET_API_KEY` — ensure it is documented in README and never logged"} ] } ```

agent_tool_risk_audit on a tool schema with bare-string cmd / url, a URL+data exfil shape, and verify_ssl: false.

```json { "tool_name": "shell_exec", "detected_format": "mcp", "findings": [ {"category": "ambiguous-description", "severity": "medium", "path": "", "message": "description is very short (5 chars) — high risk of LLM misuse"}, {"category": "risky-name-vague-desc", "severity": "medium", "path": "", "message": "tool name suggests it executes ('exec') but description is brief — agent may misuse"}, {"category": "over-broad-param", "severity": "high", "path": "cmd", "message": "command-like param `cmd` is bare string — agent can execute arbitrary commands"}, {"category": "over-broad-param", "severity": "high", "path": "url", "message": "url-like param `url` is bare string with no `pattern` — agent can reach arbitrary hosts (SSRF / exfil)"}, {"category": "dangerous-default", "severity": "medium", "path": "verify_ssl", "message": "safety-related param `verify_ssl` defaults to `False` — disables a safeguard by default"}, {"category": "exfil-shape", "severity": "medium", "path": "", "message": "tool accepts both a URL-like destination and a data-like payload — classic exfil shape"} ] } ```

jwt_inspect on the well-known jwt.io default token — verifies signature against a small weak-secret dictionary, finds missing claims.

```json { "valid_structure": true, "header": {"alg": "HS256", "typ": "JWT"}, "payload": {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}, "weak_secret": "your-256-bit-secret", "findings": [ {"category": "missing-claim", "severity": "medium", "message": "no `exp` claim — token never expires"}, {"category": "missing-claim", "severity": "low", "message": "no `iss` claim"}, {"category": "missing-claim", "severity": "low", "message": "no `aud` claim"}, {"category": "weak-secret", "severity": "high", "message": "signature verifies with common weak secret: 'your-256-bit-secret'"} ] } ```

## Recommended companion MCP servers For deeper coverage in adjacent areas we explicitly recommend (and do not duplicate): - [PortSwigger/mcp-server](https://github.com/PortSwigger/mcp-server) — Burp Suite - [ChromeDevTools/chrome-devtools-mcp](https://github.com/ChromeDevTools/chrome-devtools-mcp) — Chrome DevTools - [invariantlabs-ai/mcp-scan](https://github.com/invariantlabs-ai/mcp-scan) — MCP config / tool-description audit (complementary to our source-level audit) - [mukul975/cve-mcp-server](https://github.com/mukul975/cve-mcp-server) — full 27-tool CVE intelligence server --- ## Install ```bash pip install mcp-security-toolkit ``` ```json { "mcpServers": { "sec": { "command": "mcp-security-toolkit" } } } ```

mcp-security-toolkit

Installation