mirror of
https://github.com/affaan-m/ECC.git
synced 2026-10-16 13:15:36 +02:00
feat(skills): add MCP dependency review skill
This commit is contained in:
Tomelias
@@ -0,0 +1,150 @@
|
||||
---
|
||||
name: mcp-dependency-review
|
||||
description: Statically review MCP configuration for mutable package references before approval or CI, without executing discovered MCP servers. Use when reviewing .mcp.json, Cursor, VS Code, Claude, Windsurf, or other repo-scoped MCP config.
|
||||
license: MIT
|
||||
---
|
||||
|
||||
# MCP Dependency Review
|
||||
|
||||
Use this skill to review MCP configuration for package references that can resolve to different code after the configuration itself was approved.
|
||||
|
||||
This is a **static review workflow**. Read configuration as text/JSON only. Do not execute discovered MCP server commands as part of the review.
|
||||
|
||||
## When to Activate
|
||||
|
||||
- Before approving a new or changed MCP configuration.
|
||||
- When reviewing `.mcp.json`, `.github/mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, or equivalent workspace configuration.
|
||||
- When adding a deterministic MCP configuration check to CI.
|
||||
- When an MCP package reference uses `@latest`, a bare package name, or a version range.
|
||||
- When a team wants to know whether a previously reviewed config can silently resolve to newer package code.
|
||||
|
||||
## Review Boundary
|
||||
|
||||
Default to the repository or workspace the user asked about. Do not inspect home-directory or machine-wide MCP configuration unless the user explicitly requests that broader scope.
|
||||
|
||||
Do not:
|
||||
|
||||
- run a `command` or `args` value found in MCP configuration;
|
||||
- start an MCP server to confirm a static finding;
|
||||
- install or resolve a referenced package merely to classify its version selector;
|
||||
- copy credentials, headers, tokens, or secret values into the report;
|
||||
- describe dependency mutability alone as proof of a vulnerability, compromise, or malicious package.
|
||||
|
||||
## Static Classification Rules
|
||||
|
||||
For npm/npx-style package selectors, classify the package reference itself:
|
||||
|
||||
| Selector | Result | Why |
|
||||
| --- | --- | --- |
|
||||
| `package@1.2.3` | SAFE | Exact semantic version is reproducible. |
|
||||
| `package` | HIGH | A future resolution can select different package code. |
|
||||
| `@scope/package` | HIGH | Scoped bare package is still mutable. |
|
||||
| `package@latest` | HIGH | The selector is explicitly mutable. |
|
||||
| `package@^1.2.0` | MEDIUM | Resolution can move within the range. |
|
||||
| `package@~1.2.0` | MEDIUM | Resolution can move within the range. |
|
||||
| wildcard / inequality / other range | MEDIUM | Selector permits more than one version. |
|
||||
| local path / script / unknown binary | REVIEW | Package-version drift rules do not establish its update behavior. |
|
||||
|
||||
Treat `-y` / `--yes` only as context. It suppresses interactive confirmation; it is not a vulnerability by itself.
|
||||
|
||||
## Review Workflow
|
||||
|
||||
### 1. Locate repo-scoped configuration
|
||||
|
||||
Check only relevant workspace paths first, for example:
|
||||
|
||||
```text
|
||||
.mcp.json
|
||||
.github/mcp.json
|
||||
.cursor/mcp.json
|
||||
.vscode/mcp.json
|
||||
.windsurf/mcp.json
|
||||
```
|
||||
|
||||
Also inspect another MCP config path when the user names it explicitly.
|
||||
|
||||
### 2. Parse without executing
|
||||
|
||||
Read JSON or configuration text and identify each configured MCP server. For package-runner invocations such as `npx`, `npm exec`, `bunx`, `bun x`, `pnpm dlx`, or `yarn dlx`, isolate the package selector from command-line flags.
|
||||
|
||||
Never execute the discovered command to learn what it does.
|
||||
|
||||
### 3. Classify the selector
|
||||
|
||||
Apply the static classification table above. If the syntax is ambiguous, return REVIEW rather than guessing.
|
||||
|
||||
### 4. Recommend a reproducible fix
|
||||
|
||||
For mutable selectors, recommend an exact package version that the team has actually reviewed.
|
||||
|
||||
Do **not** invent a pin by substituting today's latest registry version. If the reviewed version is unknown, say so. A registry-history lookup is a separate network operation and should only be performed when the user asks for it.
|
||||
|
||||
### 5. Produce a bounded report
|
||||
|
||||
Use a compact table:
|
||||
|
||||
| Config | MCP server | Package/reference | Result | Why | Next step |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
|
||||
End with these boundaries:
|
||||
|
||||
- No MCP servers were executed during this review.
|
||||
- Mutable dependency references are reproducibility/review signals, not breach claims.
|
||||
- A clean result here is not a complete MCP security assessment.
|
||||
|
||||
## Example
|
||||
|
||||
Given:
|
||||
|
||||
```json
|
||||
{
|
||||
"mcpServers": {
|
||||
"browser": {
|
||||
"command": "npx",
|
||||
"args": ["-y", "example-browser-mcp@latest"]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Report:
|
||||
|
||||
```text
|
||||
.mcp.json | browser | example-browser-mcp@latest | HIGH
|
||||
Reason: @latest can resolve to different package code later without a config diff.
|
||||
Next: pin the exact version the team reviews and update it deliberately.
|
||||
```
|
||||
|
||||
## Anti-Patterns
|
||||
|
||||
### Calling every mutable reference a vulnerability
|
||||
|
||||
**Wrong:** `@latest` means the MCP package is compromised.
|
||||
|
||||
**Better:** `@latest` means the configuration does not fully determine which package version will run later. Establish actual security impact separately.
|
||||
|
||||
### Pinning whatever is latest today
|
||||
|
||||
**Wrong:** replace a mutable selector with the current registry version and call the review fixed.
|
||||
|
||||
**Better:** pin a version the team has reviewed. If that evidence is unavailable, record the uncertainty.
|
||||
|
||||
### Expanding scope silently
|
||||
|
||||
**Wrong:** a repo review automatically scans user-level Claude, Cursor, or VS Code configuration.
|
||||
|
||||
**Better:** remain workspace-scoped unless machine-wide review is explicitly requested.
|
||||
|
||||
### Treating a clean drift review as complete MCP security
|
||||
|
||||
Exact dependency pins do not prove safe authorization, prompt-injection resistance, package provenance, secure implementation, or runtime isolation.
|
||||
|
||||
## Related Skills
|
||||
|
||||
- `mcp-server-patterns` — MCP server design, tools, resources, prompts, and transports.
|
||||
- `security-review` — broader application-security checklist.
|
||||
- `security-scan` — broader security scanning workflow.
|
||||
|
||||
## Further Reading
|
||||
|
||||
A public reference implementation and reproducible research methodology for this narrow review class are available in [MCP Drift Check](https://github.com/tomelias10/mcp-drift-check). The external project is optional; this ECC skill does not require it to perform the static review.
|
||||
@@ -0,0 +1,7 @@
|
||||
interface:
|
||||
display_name: "MCP Dependency Review"
|
||||
short_description: "Review mutable MCP package references"
|
||||
brand_color: "#0EA5E9"
|
||||
default_prompt: "Use $mcp-dependency-review to statically review this repository's MCP configuration without executing discovered servers."
|
||||
policy:
|
||||
allow_implicit_invocation: true
|
||||
@@ -11,7 +11,7 @@
|
||||
{
|
||||
"name": "ecc",
|
||||
"source": "./",
|
||||
"description": "Harness-native ECC operator layer - 68 agents, 292 skills, 94 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
|
||||
"description": "Harness-native ECC operator layer - 68 agents, 293 skills, 94 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses",
|
||||
"version": "2.2.2",
|
||||
"author": {
|
||||
"name": "Affaan Mustafa",
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "ecc",
|
||||
"version": "2.2.2",
|
||||
"description": "Harness-native ECC plugin for engineering teams - 68 agents, 292 skills, 94 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
|
||||
"description": "Harness-native ECC plugin for engineering teams - 68 agents, 293 skills, 94 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses",
|
||||
"author": {
|
||||
"name": "Affaan Mustafa",
|
||||
"url": "https://x.com/affaanmustafa"
|
||||
|
||||
@@ -0,0 +1,150 @@
|
||||
---
|
||||
name: mcp-dependency-review
|
||||
description: Statically review MCP configuration for mutable package references before approval or CI, without executing discovered MCP servers.
|
||||
origin: ECC
|
||||
---
|
||||
|
||||
# MCP Dependency Review
|
||||
|
||||
Use this skill to review MCP configuration for package references that can resolve to different code after the configuration itself was approved.
|
||||
|
||||
This is a **static review workflow**. Read configuration as text/JSON only. Do not execute discovered MCP server commands as part of the review.
|
||||
|
||||
## When to Activate
|
||||
|
||||
- Before approving a new or changed MCP configuration.
|
||||
- When reviewing `.mcp.json`, `.github/mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, or equivalent workspace configuration.
|
||||
- When adding a deterministic MCP configuration check to CI.
|
||||
- When an MCP package reference uses `@latest`, a bare package name, or a version range.
|
||||
- When a team wants to know whether a previously reviewed config can silently resolve to newer package code.
|
||||
|
||||
## Review Boundary
|
||||
|
||||
Default to the repository or workspace the user asked about. Do not inspect home-directory or machine-wide MCP configuration unless the user explicitly requests that broader scope.
|
||||
|
||||
Do not:
|
||||
|
||||
- run a `command` or `args` value found in MCP configuration;
|
||||
- start an MCP server to confirm a static finding;
|
||||
- install or resolve a referenced package merely to classify its version selector;
|
||||
- copy credentials, headers, tokens, or secret values into the report;
|
||||
- describe dependency mutability alone as proof of a vulnerability, compromise, or malicious package.
|
||||
|
||||
## Static Classification Rules
|
||||
|
||||
For npm/npx-style package selectors, classify the package reference itself:
|
||||
|
||||
| Selector | Result | Why |
|
||||
| --- | --- | --- |
|
||||
| `package@1.2.3` | SAFE | Exact semantic version is reproducible. |
|
||||
| `package` | HIGH | A future resolution can select different package code. |
|
||||
| `@scope/package` | HIGH | Scoped bare package is still mutable. |
|
||||
| `package@latest` | HIGH | The selector is explicitly mutable. |
|
||||
| `package@^1.2.0` | MEDIUM | Resolution can move within the range. |
|
||||
| `package@~1.2.0` | MEDIUM | Resolution can move within the range. |
|
||||
| wildcard / inequality / other range | MEDIUM | Selector permits more than one version. |
|
||||
| local path / script / unknown binary | REVIEW | Package-version drift rules do not establish its update behavior. |
|
||||
|
||||
Treat `-y` / `--yes` only as context. It suppresses interactive confirmation; it is not a vulnerability by itself.
|
||||
|
||||
## Review Workflow
|
||||
|
||||
### 1. Locate repo-scoped configuration
|
||||
|
||||
Check only relevant workspace paths first, for example:
|
||||
|
||||
```text
|
||||
.mcp.json
|
||||
.github/mcp.json
|
||||
.cursor/mcp.json
|
||||
.vscode/mcp.json
|
||||
.windsurf/mcp.json
|
||||
```
|
||||
|
||||
Also inspect another MCP config path when the user names it explicitly.
|
||||
|
||||
### 2. Parse without executing
|
||||
|
||||
Read JSON or configuration text and identify each configured MCP server. For package-runner invocations such as `npx`, `npm exec`, `bunx`, `bun x`, `pnpm dlx`, or `yarn dlx`, isolate the package selector from command-line flags.
|
||||
|
||||
Never execute the discovered command to learn what it does.
|
||||
|
||||
### 3. Classify the selector
|
||||
|
||||
Apply the static classification table above. If the syntax is ambiguous, return REVIEW rather than guessing.
|
||||
|
||||
### 4. Recommend a reproducible fix
|
||||
|
||||
For mutable selectors, recommend an exact package version that the team has actually reviewed.
|
||||
|
||||
Do **not** invent a pin by substituting today's latest registry version. If the reviewed version is unknown, say so. A registry-history lookup is a separate network operation and should only be performed when the user asks for it.
|
||||
|
||||
### 5. Produce a bounded report
|
||||
|
||||
Use a compact table:
|
||||
|
||||
| Config | MCP server | Package/reference | Result | Why | Next step |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
|
||||
End with these boundaries:
|
||||
|
||||
- No MCP servers were executed during this review.
|
||||
- Mutable dependency references are reproducibility/review signals, not breach claims.
|
||||
- A clean result here is not a complete MCP security assessment.
|
||||
|
||||
## Example
|
||||
|
||||
Given:
|
||||
|
||||
```json
|
||||
{
|
||||
"mcpServers": {
|
||||
"browser": {
|
||||
"command": "npx",
|
||||
"args": ["-y", "example-browser-mcp@latest"]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Report:
|
||||
|
||||
```text
|
||||
.mcp.json | browser | example-browser-mcp@latest | HIGH
|
||||
Reason: @latest can resolve to different package code later without a config diff.
|
||||
Next: pin the exact version the team reviews and update it deliberately.
|
||||
```
|
||||
|
||||
## Anti-Patterns
|
||||
|
||||
### Calling every mutable reference a vulnerability
|
||||
|
||||
**Wrong:** `@latest` means the MCP package is compromised.
|
||||
|
||||
**Better:** `@latest` means the configuration does not fully determine which package version will run later. Establish actual security impact separately.
|
||||
|
||||
### Pinning whatever is latest today
|
||||
|
||||
**Wrong:** replace a mutable selector with the current registry version and call the review fixed.
|
||||
|
||||
**Better:** pin a version the team has reviewed. If that evidence is unavailable, record the uncertainty.
|
||||
|
||||
### Expanding scope silently
|
||||
|
||||
**Wrong:** a repo review automatically scans user-level Claude, Cursor, or VS Code configuration.
|
||||
|
||||
**Better:** remain workspace-scoped unless machine-wide review is explicitly requested.
|
||||
|
||||
### Treating a clean drift review as complete MCP security
|
||||
|
||||
Exact dependency pins do not prove safe authorization, prompt-injection resistance, package provenance, secure implementation, or runtime isolation.
|
||||
|
||||
## Related Skills
|
||||
|
||||
- `mcp-server-patterns` — MCP server design, tools, resources, prompts, and transports.
|
||||
- `security-review` — broader application-security checklist.
|
||||
- `security-scan` — broader security scanning workflow.
|
||||
|
||||
## Further Reading
|
||||
|
||||
A public reference implementation and reproducible research methodology for this narrow review class are available in [MCP Drift Check](https://github.com/tomelias10/mcp-drift-check). The external project is optional; this ECC skill does not require it to perform the static review.
|
||||
@@ -1,6 +1,6 @@
|
||||
# Everything Claude Code (ECC) — Agent Instructions
|
||||
|
||||
This is a **production-ready AI coding plugin** providing 68 specialized agents, 292 skills, 94 commands, and automated hook workflows for software development.
|
||||
This is a **production-ready AI coding plugin** providing 68 specialized agents, 293 skills, 94 commands, and automated hook workflows for software development.
|
||||
|
||||
**Version:** 2.2.2
|
||||
|
||||
@@ -154,7 +154,7 @@ Troubleshoot failures: check test isolation → verify mocks → fix implementat
|
||||
|
||||
```
|
||||
agents/ — 68 specialized subagents
|
||||
skills/ — 292 workflow skills and domain knowledge
|
||||
skills/ — 293 workflow skills and domain knowledge
|
||||
commands/ — 94 slash commands
|
||||
hooks/ — Trigger-based automations
|
||||
rules/ — Always-follow guidelines (common + per-language)
|
||||
|
||||
@@ -138,12 +138,12 @@ Instead of rebuilding that process in every prompt, you install it once and make
|
||||
|
||||
ECC is MIT-licensed open source. It works best with Claude Code today, has a supported Codex sync path, and provides capability-limited adapters for Cursor, OpenCode, Gemini, Zed, GitHub Copilot, Antigravity, Qwen, and other harnesses. See the [support status matrix](#platform-support) before assuming feature parity.
|
||||
|
||||
Access to 68 agents, 292 skills, and 94 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work.
|
||||
Access to 68 agents, 293 skills, and 94 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work.
|
||||
|
||||
| Included | Count | What it gives you |
|
||||
| ---------------- | ----------: | ------------------------------------------------------------------------------------ |
|
||||
| Agents | 68 agents | Planning, review, build repair, security, architecture, and domain work |
|
||||
| Skills | 292 skills | TDD, research, security, docs, frontend, data, ML, operations, and more |
|
||||
| Skills | 293 skills | TDD, research, security, docs, frontend, data, ML, operations, and more |
|
||||
| Commands | 94 commands | Convenient entry points while ECC moves to a skills-first surface |
|
||||
| Hooks and memory | Runtime | Enforcement, session summaries, continuous learning, instincts, and context controls |
|
||||
| Rules | Selective | Always-loaded standards you choose by language or project |
|
||||
|
||||
+1
-1
@@ -196,7 +196,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
|
||||
/plugin list ecc@ecc
|
||||
```
|
||||
|
||||
**完成！** 你现在可以使用 68 个代理、292 个技能和 94 个命令。
|
||||
**完成！** 你现在可以使用 68 个代理、293 个技能和 94 个命令。
|
||||
|
||||
### multi-* 命令需要额外配置
|
||||
|
||||
|
||||
@@ -99,6 +99,7 @@ skills:
|
||||
- liquid-glass-design
|
||||
- logistics-exception-management
|
||||
- market-research
|
||||
- mcp-dependency-review
|
||||
- mcp-server-patterns
|
||||
- motion-advanced
|
||||
- motion-foundations
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Everything Claude Code (ECC) — 智能体指令
|
||||
|
||||
这是一个**生产就绪的 AI 编码插件**，提供 68 个专业代理、292 项技能、94 条命令以及自动化钩子工作流，用于软件开发。
|
||||
这是一个**生产就绪的 AI 编码插件**，提供 68 个专业代理、293 项技能、94 条命令以及自动化钩子工作流，用于软件开发。
|
||||
|
||||
**版本:** 2.2.2
|
||||
|
||||
@@ -147,7 +147,7 @@
|
||||
|
||||
```
|
||||
agents/ — 68 个专业子代理
|
||||
skills/ — 292 个工作流技能和领域知识
|
||||
skills/ — 293 个工作流技能和领域知识
|
||||
commands/ — 94 个斜杠命令
|
||||
hooks/ — 基于触发的自动化
|
||||
rules/ — 始终遵循的指导方针（通用 + 每种语言）
|
||||
|
||||
@@ -260,7 +260,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
|
||||
/plugin list ecc@ecc
|
||||
```
|
||||
|
||||
**搞定！** 你现在可以使用 68 个智能体、292 项技能和 94 个命令了。
|
||||
**搞定！** 你现在可以使用 68 个智能体、293 项技能和 94 个命令了。
|
||||
|
||||
***
|
||||
|
||||
@@ -1174,7 +1174,7 @@ opencode
|
||||
|---------|---------------|----------|--------|
|
||||
| 智能体 | PASS: 68 个 | PASS: 12 个 | **Claude Code 领先** |
|
||||
| 命令 | PASS: 94 个 | PASS: 35 个 | **Claude Code 领先** |
|
||||
| 技能 | PASS: 292 项 | PASS: 37 项 | **Claude Code 领先** |
|
||||
| 技能 | PASS: 293 项 | PASS: 37 项 | **Claude Code 领先** |
|
||||
| 钩子 | PASS: 8 种事件类型 | PASS: 11 种事件 | **OpenCode 更多！** |
|
||||
| 规则 | PASS: 29 条 | PASS: 13 条指令 | **Claude Code 领先** |
|
||||
| MCP 服务器 | PASS: 14 个 | PASS: 完整 | **完全对等** |
|
||||
@@ -1282,7 +1282,7 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以
|
||||
|---------|-----------------------|------------|-----------|----------|
|
||||
| **智能体** | 68 | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 |
|
||||
| **命令** | 94 | 共享 | 基于指令 | 35 |
|
||||
| **技能** | 292 | 共享 | 10 (原生格式) | 37 |
|
||||
| **技能** | 293 | 共享 | 10 (原生格式) | 37 |
|
||||
| **钩子事件** | 8 种类型 | 15 种类型 | SessionStart（1 种类型） | 11 种类型 |
|
||||
| **钩子脚本** | 20+ 个脚本 | 16 个脚本 (DRY 适配器) | 1 个 SessionStart 引导脚本 | 插件钩子 |
|
||||
| **规则** | 34 (通用 + 语言) | 34 (YAML 前页) | 基于指令 | 13 条指令 |
|
||||
|
||||
@@ -430,6 +430,7 @@
|
||||
"skills/hipaa-compliance",
|
||||
"skills/laravel-security",
|
||||
"skills/llm-trading-agent-security",
|
||||
"skills/mcp-dependency-review",
|
||||
"skills/nodejs-keccak256",
|
||||
"skills/perl-security",
|
||||
"skills/quarkus-security",
|
||||
|
||||
@@ -278,6 +278,7 @@
|
||||
"skills/manim-video/",
|
||||
"skills/market-research/",
|
||||
"skills/make-interfaces-feel-better/",
|
||||
"skills/mcp-dependency-review/",
|
||||
"skills/mcp-server-patterns/",
|
||||
"skills/messages-ops/",
|
||||
"skills/mle-workflow/",
|
||||
|
||||
@@ -0,0 +1,151 @@
|
||||
---
|
||||
name: mcp-dependency-review
|
||||
description: Statically review MCP configuration for mutable package references before approval or CI, without executing discovered MCP servers. Use when reviewing .mcp.json, Cursor, VS Code, Claude, Windsurf, or other repo-scoped MCP config.
|
||||
metadata:
|
||||
origin: ECC
|
||||
---
|
||||
|
||||
# MCP Dependency Review
|
||||
|
||||
Use this skill to review MCP configuration for package references that can resolve to different code after the configuration itself was approved.
|
||||
|
||||
This is a **static review workflow**. Read configuration as text/JSON only. Do not execute discovered MCP server commands as part of the review.
|
||||
|
||||
## When to Activate
|
||||
|
||||
- Before approving a new or changed MCP configuration.
|
||||
- When reviewing `.mcp.json`, `.github/mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, or equivalent workspace configuration.
|
||||
- When adding a deterministic MCP configuration check to CI.
|
||||
- When an MCP package reference uses `@latest`, a bare package name, or a version range.
|
||||
- When a team wants to know whether a previously reviewed config can silently resolve to newer package code.
|
||||
|
||||
## Review Boundary
|
||||
|
||||
Default to the repository or workspace the user asked about. Do not inspect home-directory or machine-wide MCP configuration unless the user explicitly requests that broader scope.
|
||||
|
||||
Do not:
|
||||
|
||||
- run a `command` or `args` value found in MCP configuration;
|
||||
- start an MCP server to confirm a static finding;
|
||||
- install or resolve a referenced package merely to classify its version selector;
|
||||
- copy credentials, headers, tokens, or secret values into the report;
|
||||
- describe dependency mutability alone as proof of a vulnerability, compromise, or malicious package.
|
||||
|
||||
## Static Classification Rules
|
||||
|
||||
For npm/npx-style package selectors, classify the package reference itself:
|
||||
|
||||
| Selector | Result | Why |
|
||||
| --- | --- | --- |
|
||||
| `package@1.2.3` | SAFE | Exact semantic version is reproducible. |
|
||||
| `package` | HIGH | A future resolution can select different package code. |
|
||||
| `@scope/package` | HIGH | Scoped bare package is still mutable. |
|
||||
| `package@latest` | HIGH | The selector is explicitly mutable. |
|
||||
| `package@^1.2.0` | MEDIUM | Resolution can move within the range. |
|
||||
| `package@~1.2.0` | MEDIUM | Resolution can move within the range. |
|
||||
| wildcard / inequality / other range | MEDIUM | Selector permits more than one version. |
|
||||
| local path / script / unknown binary | REVIEW | Package-version drift rules do not establish its update behavior. |
|
||||
|
||||
Treat `-y` / `--yes` only as context. It suppresses interactive confirmation; it is not a vulnerability by itself.
|
||||
|
||||
## Review Workflow
|
||||
|
||||
### 1. Locate repo-scoped configuration
|
||||
|
||||
Check only relevant workspace paths first, for example:
|
||||
|
||||
```text
|
||||
.mcp.json
|
||||
.github/mcp.json
|
||||
.cursor/mcp.json
|
||||
.vscode/mcp.json
|
||||
.windsurf/mcp.json
|
||||
```
|
||||
|
||||
Also inspect another MCP config path when the user names it explicitly.
|
||||
|
||||
### 2. Parse without executing
|
||||
|
||||
Read JSON or configuration text and identify each configured MCP server. For package-runner invocations such as `npx`, `npm exec`, `bunx`, `bun x`, `pnpm dlx`, or `yarn dlx`, isolate the package selector from command-line flags.
|
||||
|
||||
Never execute the discovered command to learn what it does.
|
||||
|
||||
### 3. Classify the selector
|
||||
|
||||
Apply the static classification table above. If the syntax is ambiguous, return REVIEW rather than guessing.
|
||||
|
||||
### 4. Recommend a reproducible fix
|
||||
|
||||
For mutable selectors, recommend an exact package version that the team has actually reviewed.
|
||||
|
||||
Do **not** invent a pin by substituting today's latest registry version. If the reviewed version is unknown, say so. A registry-history lookup is a separate network operation and should only be performed when the user asks for it.
|
||||
|
||||
### 5. Produce a bounded report
|
||||
|
||||
Use a compact table:
|
||||
|
||||
| Config | MCP server | Package/reference | Result | Why | Next step |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
|
||||
End with these boundaries:
|
||||
|
||||
- No MCP servers were executed during this review.
|
||||
- Mutable dependency references are reproducibility/review signals, not breach claims.
|
||||
- A clean result here is not a complete MCP security assessment.
|
||||
|
||||
## Example
|
||||
|
||||
Given:
|
||||
|
||||
```json
|
||||
{
|
||||
"mcpServers": {
|
||||
"browser": {
|
||||
"command": "npx",
|
||||
"args": ["-y", "example-browser-mcp@latest"]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Report:
|
||||
|
||||
```text
|
||||
.mcp.json | browser | example-browser-mcp@latest | HIGH
|
||||
Reason: @latest can resolve to different package code later without a config diff.
|
||||
Next: pin the exact version the team reviews and update it deliberately.
|
||||
```
|
||||
|
||||
## Anti-Patterns
|
||||
|
||||
### Calling every mutable reference a vulnerability
|
||||
|
||||
**Wrong:** `@latest` means the MCP package is compromised.
|
||||
|
||||
**Better:** `@latest` means the configuration does not fully determine which package version will run later. Establish actual security impact separately.
|
||||
|
||||
### Pinning whatever is latest today
|
||||
|
||||
**Wrong:** replace a mutable selector with the current registry version and call the review fixed.
|
||||
|
||||
**Better:** pin a version the team has reviewed. If that evidence is unavailable, record the uncertainty.
|
||||
|
||||
### Expanding scope silently
|
||||
|
||||
**Wrong:** a repo review automatically scans user-level Claude, Cursor, or VS Code configuration.
|
||||
|
||||
**Better:** remain workspace-scoped unless machine-wide review is explicitly requested.
|
||||
|
||||
### Treating a clean drift review as complete MCP security
|
||||
|
||||
Exact dependency pins do not prove safe authorization, prompt-injection resistance, package provenance, secure implementation, or runtime isolation.
|
||||
|
||||
## Related Skills
|
||||
|
||||
- `mcp-server-patterns` — MCP server design, tools, resources, prompts, and transports.
|
||||
- `security-review` — broader application-security checklist.
|
||||
- `security-scan` — broader security scanning workflow.
|
||||
|
||||
## Further Reading
|
||||
|
||||
A public reference implementation and reproducible research methodology for this narrow review class are available in [MCP Drift Check](https://github.com/tomelias10/mcp-drift-check). The external project is optional; this ECC skill does not require it to perform the static review.
|
||||
Reference in New Issue
Block a user