From 7fbdc55feac5730952debc35779305fe4987cdff Mon Sep 17 00:00:00 2001 From: Tomelias Date: Fri, 25 Sep 2026 13:06:51 +0300 Subject: [PATCH] feat(skills): add MCP dependency review skill --- .agents/skills/mcp-dependency-review/SKILL.md | 150 +++++++++++++++++ .../mcp-dependency-review/agents/openai.yaml | 7 + .claude-plugin/marketplace.json | 2 +- .claude-plugin/plugin.json | 2 +- .cursor/skills/mcp-dependency-review/SKILL.md | 150 +++++++++++++++++ AGENTS.md | 4 +- README.md | 4 +- README.zh-CN.md | 2 +- agent.yaml | 1 + docs/zh-CN/AGENTS.md | 4 +- docs/zh-CN/README.md | 6 +- manifests/install-modules.json | 1 + package.json | 1 + skills/mcp-dependency-review/SKILL.md | 151 ++++++++++++++++++ 14 files changed, 473 insertions(+), 12 deletions(-) create mode 100644 .agents/skills/mcp-dependency-review/SKILL.md create mode 100644 .agents/skills/mcp-dependency-review/agents/openai.yaml create mode 100644 .cursor/skills/mcp-dependency-review/SKILL.md create mode 100644 skills/mcp-dependency-review/SKILL.md diff --git a/.agents/skills/mcp-dependency-review/SKILL.md b/.agents/skills/mcp-dependency-review/SKILL.md new file mode 100644 index 000000000..86ac921c0 --- /dev/null +++ b/.agents/skills/mcp-dependency-review/SKILL.md @@ -0,0 +1,150 @@ +--- +name: mcp-dependency-review +description: Statically review MCP configuration for mutable package references before approval or CI, without executing discovered MCP servers. Use when reviewing .mcp.json, Cursor, VS Code, Claude, Windsurf, or other repo-scoped MCP config. +license: MIT +--- + +# MCP Dependency Review + +Use this skill to review MCP configuration for package references that can resolve to different code after the configuration itself was approved. + +This is a **static review workflow**. Read configuration as text/JSON only. Do not execute discovered MCP server commands as part of the review. + +## When to Activate + +- Before approving a new or changed MCP configuration. +- When reviewing `.mcp.json`, `.github/mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, or equivalent workspace configuration. +- When adding a deterministic MCP configuration check to CI. +- When an MCP package reference uses `@latest`, a bare package name, or a version range. +- When a team wants to know whether a previously reviewed config can silently resolve to newer package code. + +## Review Boundary + +Default to the repository or workspace the user asked about. Do not inspect home-directory or machine-wide MCP configuration unless the user explicitly requests that broader scope. + +Do not: + +- run a `command` or `args` value found in MCP configuration; +- start an MCP server to confirm a static finding; +- install or resolve a referenced package merely to classify its version selector; +- copy credentials, headers, tokens, or secret values into the report; +- describe dependency mutability alone as proof of a vulnerability, compromise, or malicious package. + +## Static Classification Rules + +For npm/npx-style package selectors, classify the package reference itself: + +| Selector | Result | Why | +| --- | --- | --- | +| `package@1.2.3` | SAFE | Exact semantic version is reproducible. | +| `package` | HIGH | A future resolution can select different package code. | +| `@scope/package` | HIGH | Scoped bare package is still mutable. | +| `package@latest` | HIGH | The selector is explicitly mutable. | +| `package@^1.2.0` | MEDIUM | Resolution can move within the range. | +| `package@~1.2.0` | MEDIUM | Resolution can move within the range. | +| wildcard / inequality / other range | MEDIUM | Selector permits more than one version. | +| local path / script / unknown binary | REVIEW | Package-version drift rules do not establish its update behavior. | + +Treat `-y` / `--yes` only as context. It suppresses interactive confirmation; it is not a vulnerability by itself. + +## Review Workflow + +### 1. Locate repo-scoped configuration + +Check only relevant workspace paths first, for example: + +```text +.mcp.json +.github/mcp.json +.cursor/mcp.json +.vscode/mcp.json +.windsurf/mcp.json +``` + +Also inspect another MCP config path when the user names it explicitly. + +### 2. Parse without executing + +Read JSON or configuration text and identify each configured MCP server. For package-runner invocations such as `npx`, `npm exec`, `bunx`, `bun x`, `pnpm dlx`, or `yarn dlx`, isolate the package selector from command-line flags. + +Never execute the discovered command to learn what it does. + +### 3. Classify the selector + +Apply the static classification table above. If the syntax is ambiguous, return REVIEW rather than guessing. + +### 4. Recommend a reproducible fix + +For mutable selectors, recommend an exact package version that the team has actually reviewed. + +Do **not** invent a pin by substituting today's latest registry version. If the reviewed version is unknown, say so. A registry-history lookup is a separate network operation and should only be performed when the user asks for it. + +### 5. Produce a bounded report + +Use a compact table: + +| Config | MCP server | Package/reference | Result | Why | Next step | +| --- | --- | --- | --- | --- | --- | + +End with these boundaries: + +- No MCP servers were executed during this review. +- Mutable dependency references are reproducibility/review signals, not breach claims. +- A clean result here is not a complete MCP security assessment. + +## Example + +Given: + +```json +{ + "mcpServers": { + "browser": { + "command": "npx", + "args": ["-y", "example-browser-mcp@latest"] + } + } +} +``` + +Report: + +```text +.mcp.json | browser | example-browser-mcp@latest | HIGH +Reason: @latest can resolve to different package code later without a config diff. +Next: pin the exact version the team reviews and update it deliberately. +``` + +## Anti-Patterns + +### Calling every mutable reference a vulnerability + +**Wrong:** `@latest` means the MCP package is compromised. + +**Better:** `@latest` means the configuration does not fully determine which package version will run later. Establish actual security impact separately. + +### Pinning whatever is latest today + +**Wrong:** replace a mutable selector with the current registry version and call the review fixed. + +**Better:** pin a version the team has reviewed. If that evidence is unavailable, record the uncertainty. + +### Expanding scope silently + +**Wrong:** a repo review automatically scans user-level Claude, Cursor, or VS Code configuration. + +**Better:** remain workspace-scoped unless machine-wide review is explicitly requested. + +### Treating a clean drift review as complete MCP security + +Exact dependency pins do not prove safe authorization, prompt-injection resistance, package provenance, secure implementation, or runtime isolation. + +## Related Skills + +- `mcp-server-patterns` — MCP server design, tools, resources, prompts, and transports. +- `security-review` — broader application-security checklist. +- `security-scan` — broader security scanning workflow. + +## Further Reading + +A public reference implementation and reproducible research methodology for this narrow review class are available in [MCP Drift Check](https://github.com/tomelias10/mcp-drift-check). The external project is optional; this ECC skill does not require it to perform the static review. diff --git a/.agents/skills/mcp-dependency-review/agents/openai.yaml b/.agents/skills/mcp-dependency-review/agents/openai.yaml new file mode 100644 index 000000000..6ffc64aa1 --- /dev/null +++ b/.agents/skills/mcp-dependency-review/agents/openai.yaml @@ -0,0 +1,7 @@ +interface: + display_name: "MCP Dependency Review" + short_description: "Review mutable MCP package references" + brand_color: "#0EA5E9" + default_prompt: "Use $mcp-dependency-review to statically review this repository's MCP configuration without executing discovered servers." +policy: + allow_implicit_invocation: true diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index b19c87b8d..d5385a381 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -11,7 +11,7 @@ { "name": "ecc", "source": "./", - "description": "Harness-native ECC operator layer - 68 agents, 292 skills, 94 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses", + "description": "Harness-native ECC operator layer - 68 agents, 293 skills, 94 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses", "version": "2.2.2", "author": { "name": "Affaan Mustafa", diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 072edddfe..8871e37d2 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "ecc", "version": "2.2.2", - "description": "Harness-native ECC plugin for engineering teams - 68 agents, 292 skills, 94 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses", + "description": "Harness-native ECC plugin for engineering teams - 68 agents, 293 skills, 94 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses", "author": { "name": "Affaan Mustafa", "url": "https://x.com/affaanmustafa" diff --git a/.cursor/skills/mcp-dependency-review/SKILL.md b/.cursor/skills/mcp-dependency-review/SKILL.md new file mode 100644 index 000000000..fba6f89ae --- /dev/null +++ b/.cursor/skills/mcp-dependency-review/SKILL.md @@ -0,0 +1,150 @@ +--- +name: mcp-dependency-review +description: Statically review MCP configuration for mutable package references before approval or CI, without executing discovered MCP servers. +origin: ECC +--- + +# MCP Dependency Review + +Use this skill to review MCP configuration for package references that can resolve to different code after the configuration itself was approved. + +This is a **static review workflow**. Read configuration as text/JSON only. Do not execute discovered MCP server commands as part of the review. + +## When to Activate + +- Before approving a new or changed MCP configuration. +- When reviewing `.mcp.json`, `.github/mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, or equivalent workspace configuration. +- When adding a deterministic MCP configuration check to CI. +- When an MCP package reference uses `@latest`, a bare package name, or a version range. +- When a team wants to know whether a previously reviewed config can silently resolve to newer package code. + +## Review Boundary + +Default to the repository or workspace the user asked about. Do not inspect home-directory or machine-wide MCP configuration unless the user explicitly requests that broader scope. + +Do not: + +- run a `command` or `args` value found in MCP configuration; +- start an MCP server to confirm a static finding; +- install or resolve a referenced package merely to classify its version selector; +- copy credentials, headers, tokens, or secret values into the report; +- describe dependency mutability alone as proof of a vulnerability, compromise, or malicious package. + +## Static Classification Rules + +For npm/npx-style package selectors, classify the package reference itself: + +| Selector | Result | Why | +| --- | --- | --- | +| `package@1.2.3` | SAFE | Exact semantic version is reproducible. | +| `package` | HIGH | A future resolution can select different package code. | +| `@scope/package` | HIGH | Scoped bare package is still mutable. | +| `package@latest` | HIGH | The selector is explicitly mutable. | +| `package@^1.2.0` | MEDIUM | Resolution can move within the range. | +| `package@~1.2.0` | MEDIUM | Resolution can move within the range. | +| wildcard / inequality / other range | MEDIUM | Selector permits more than one version. | +| local path / script / unknown binary | REVIEW | Package-version drift rules do not establish its update behavior. | + +Treat `-y` / `--yes` only as context. It suppresses interactive confirmation; it is not a vulnerability by itself. + +## Review Workflow + +### 1. Locate repo-scoped configuration + +Check only relevant workspace paths first, for example: + +```text +.mcp.json +.github/mcp.json +.cursor/mcp.json +.vscode/mcp.json +.windsurf/mcp.json +``` + +Also inspect another MCP config path when the user names it explicitly. + +### 2. Parse without executing + +Read JSON or configuration text and identify each configured MCP server. For package-runner invocations such as `npx`, `npm exec`, `bunx`, `bun x`, `pnpm dlx`, or `yarn dlx`, isolate the package selector from command-line flags. + +Never execute the discovered command to learn what it does. + +### 3. Classify the selector + +Apply the static classification table above. If the syntax is ambiguous, return REVIEW rather than guessing. + +### 4. Recommend a reproducible fix + +For mutable selectors, recommend an exact package version that the team has actually reviewed. + +Do **not** invent a pin by substituting today's latest registry version. If the reviewed version is unknown, say so. A registry-history lookup is a separate network operation and should only be performed when the user asks for it. + +### 5. Produce a bounded report + +Use a compact table: + +| Config | MCP server | Package/reference | Result | Why | Next step | +| --- | --- | --- | --- | --- | --- | + +End with these boundaries: + +- No MCP servers were executed during this review. +- Mutable dependency references are reproducibility/review signals, not breach claims. +- A clean result here is not a complete MCP security assessment. + +## Example + +Given: + +```json +{ + "mcpServers": { + "browser": { + "command": "npx", + "args": ["-y", "example-browser-mcp@latest"] + } + } +} +``` + +Report: + +```text +.mcp.json | browser | example-browser-mcp@latest | HIGH +Reason: @latest can resolve to different package code later without a config diff. +Next: pin the exact version the team reviews and update it deliberately. +``` + +## Anti-Patterns + +### Calling every mutable reference a vulnerability + +**Wrong:** `@latest` means the MCP package is compromised. + +**Better:** `@latest` means the configuration does not fully determine which package version will run later. Establish actual security impact separately. + +### Pinning whatever is latest today + +**Wrong:** replace a mutable selector with the current registry version and call the review fixed. + +**Better:** pin a version the team has reviewed. If that evidence is unavailable, record the uncertainty. + +### Expanding scope silently + +**Wrong:** a repo review automatically scans user-level Claude, Cursor, or VS Code configuration. + +**Better:** remain workspace-scoped unless machine-wide review is explicitly requested. + +### Treating a clean drift review as complete MCP security + +Exact dependency pins do not prove safe authorization, prompt-injection resistance, package provenance, secure implementation, or runtime isolation. + +## Related Skills + +- `mcp-server-patterns` — MCP server design, tools, resources, prompts, and transports. +- `security-review` — broader application-security checklist. +- `security-scan` — broader security scanning workflow. + +## Further Reading + +A public reference implementation and reproducible research methodology for this narrow review class are available in [MCP Drift Check](https://github.com/tomelias10/mcp-drift-check). The external project is optional; this ECC skill does not require it to perform the static review. diff --git a/AGENTS.md b/AGENTS.md index 17330b848..c6c5acd98 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,6 +1,6 @@ # Everything Claude Code (ECC) — Agent Instructions -This is a **production-ready AI coding plugin** providing 68 specialized agents, 292 skills, 94 commands, and automated hook workflows for software development. +This is a **production-ready AI coding plugin** providing 68 specialized agents, 293 skills, 94 commands, and automated hook workflows for software development. **Version:** 2.2.2 @@ -154,7 +154,7 @@ Troubleshoot failures: check test isolation → verify mocks → fix implementat ``` agents/ — 68 specialized subagents -skills/ — 292 workflow skills and domain knowledge +skills/ — 293 workflow skills and domain knowledge commands/ — 94 slash commands hooks/ — Trigger-based automations rules/ — Always-follow guidelines (common + per-language) diff --git a/README.md b/README.md index 117552c2b..ef7ad4249 100644 --- a/README.md +++ b/README.md @@ -138,12 +138,12 @@ Instead of rebuilding that process in every prompt, you install it once and make ECC is MIT-licensed open source. It works best with Claude Code today, has a supported Codex sync path, and provides capability-limited adapters for Cursor, OpenCode, Gemini, Zed, GitHub Copilot, Antigravity, Qwen, and other harnesses. See the [support status matrix](#platform-support) before assuming feature parity. -Access to 68 agents, 292 skills, and 94 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work. +Access to 68 agents, 293 skills, and 94 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work. | Included | Count | What it gives you | | ---------------- | ----------: | ------------------------------------------------------------------------------------ | | Agents | 68 agents | Planning, review, build repair, security, architecture, and domain work | -| Skills | 292 skills | TDD, research, security, docs, frontend, data, ML, operations, and more | +| Skills | 293 skills | TDD, research, security, docs, frontend, data, ML, operations, and more | | Commands | 94 commands | Convenient entry points while ECC moves to a skills-first surface | | Hooks and memory | Runtime | Enforcement, session summaries, continuous learning, instincts, and context controls | | Rules | Selective | Always-loaded standards you choose by language or project | diff --git a/README.zh-CN.md b/README.zh-CN.md index 552d69b58..e8aacbbd9 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -196,7 +196,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/" /plugin list ecc@ecc ``` -**完成！** 你现在可以使用 68 个代理、292 个技能和 94 个命令。 +**完成！** 你现在可以使用 68 个代理、293 个技能和 94 个命令。 ### multi-* 命令需要额外配置 diff --git a/agent.yaml b/agent.yaml index 4236f04cc..0d1f154cc 100644 --- a/agent.yaml +++ b/agent.yaml @@ -99,6 +99,7 @@ skills: - liquid-glass-design - logistics-exception-management - market-research + - mcp-dependency-review - mcp-server-patterns - motion-advanced - motion-foundations diff --git a/docs/zh-CN/AGENTS.md b/docs/zh-CN/AGENTS.md index 31e1a3817..555599e2e 100644 --- a/docs/zh-CN/AGENTS.md +++ b/docs/zh-CN/AGENTS.md @@ -1,6 +1,6 @@ # Everything Claude Code (ECC) — 智能体指令 -这是一个**生产就绪的 AI 编码插件**，提供 68 个专业代理、292 项技能、94 条命令以及自动化钩子工作流，用于软件开发。 +这是一个**生产就绪的 AI 编码插件**，提供 68 个专业代理、293 项技能、94 条命令以及自动化钩子工作流，用于软件开发。 **版本:** 2.2.2 @@ -147,7 +147,7 @@ ``` agents/ — 68 个专业子代理 -skills/ — 292 个工作流技能和领域知识 +skills/ — 293 个工作流技能和领域知识 commands/ — 94 个斜杠命令 hooks/ — 基于触发的自动化 rules/ — 始终遵循的指导方针（通用 + 每种语言） diff --git a/docs/zh-CN/README.md b/docs/zh-CN/README.md index 3228c6159..e5ed37377 100644 --- a/docs/zh-CN/README.md +++ b/docs/zh-CN/README.md @@ -260,7 +260,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/" /plugin list ecc@ecc ``` -**搞定！** 你现在可以使用 68 个智能体、292 项技能和 94 个命令了。 +**搞定！** 你现在可以使用 68 个智能体、293 项技能和 94 个命令了。 *** @@ -1174,7 +1174,7 @@ opencode |---------|---------------|----------|--------| | 智能体 | PASS: 68 个 | PASS: 12 个 | **Claude Code 领先** | | 命令 | PASS: 94 个 | PASS: 35 个 | **Claude Code 领先** | -| 技能 | PASS: 292 项 | PASS: 37 项 | **Claude Code 领先** | +| 技能 | PASS: 293 项 | PASS: 37 项 | **Claude Code 领先** | | 钩子 | PASS: 8 种事件类型 | PASS: 11 种事件 | **OpenCode 更多！** | | 规则 | PASS: 29 条 | PASS: 13 条指令 | **Claude Code 领先** | | MCP 服务器 | PASS: 14 个 | PASS: 完整 | **完全对等** | @@ -1282,7 +1282,7 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以 |---------|-----------------------|------------|-----------|----------| | **智能体** | 68 | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 | | **命令** | 94 | 共享 | 基于指令 | 35 | -| **技能** | 292 | 共享 | 10 (原生格式) | 37 | +| **技能** | 293 | 共享 | 10 (原生格式) | 37 | | **钩子事件** | 8 种类型 | 15 种类型 | SessionStart（1 种类型） | 11 种类型 | | **钩子脚本** | 20+ 个脚本 | 16 个脚本 (DRY 适配器) | 1 个 SessionStart 引导脚本 | 插件钩子 | | **规则** | 34 (通用 + 语言) | 34 (YAML 前页) | 基于指令 | 13 条指令 | diff --git a/manifests/install-modules.json b/manifests/install-modules.json index 884c7d39d..369105c46 100644 --- a/manifests/install-modules.json +++ b/manifests/install-modules.json @@ -430,6 +430,7 @@ "skills/hipaa-compliance", "skills/laravel-security", "skills/llm-trading-agent-security", + "skills/mcp-dependency-review", "skills/nodejs-keccak256", "skills/perl-security", "skills/quarkus-security", diff --git a/package.json b/package.json index 6a53ed2f5..8bc66851f 100644 --- a/package.json +++ b/package.json @@ -278,6 +278,7 @@ "skills/manim-video/", "skills/market-research/", "skills/make-interfaces-feel-better/", + "skills/mcp-dependency-review/", "skills/mcp-server-patterns/", "skills/messages-ops/", "skills/mle-workflow/", diff --git a/skills/mcp-dependency-review/SKILL.md b/skills/mcp-dependency-review/SKILL.md new file mode 100644 index 000000000..8a06b520f --- /dev/null +++ b/skills/mcp-dependency-review/SKILL.md @@ -0,0 +1,151 @@ +--- +name: mcp-dependency-review +description: Statically review MCP configuration for mutable package references before approval or CI, without executing discovered MCP servers. Use when reviewing .mcp.json, Cursor, VS Code, Claude, Windsurf, or other repo-scoped MCP config. +metadata: + origin: ECC +--- + +# MCP Dependency Review + +Use this skill to review MCP configuration for package references that can resolve to different code after the configuration itself was approved. + +This is a **static review workflow**. Read configuration as text/JSON only. Do not execute discovered MCP server commands as part of the review. + +## When to Activate + +- Before approving a new or changed MCP configuration. +- When reviewing `.mcp.json`, `.github/mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, or equivalent workspace configuration. +- When adding a deterministic MCP configuration check to CI. +- When an MCP package reference uses `@latest`, a bare package name, or a version range. +- When a team wants to know whether a previously reviewed config can silently resolve to newer package code. + +## Review Boundary + +Default to the repository or workspace the user asked about. Do not inspect home-directory or machine-wide MCP configuration unless the user explicitly requests that broader scope. + +Do not: + +- run a `command` or `args` value found in MCP configuration; +- start an MCP server to confirm a static finding; +- install or resolve a referenced package merely to classify its version selector; +- copy credentials, headers, tokens, or secret values into the report; +- describe dependency mutability alone as proof of a vulnerability, compromise, or malicious package. + +## Static Classification Rules + +For npm/npx-style package selectors, classify the package reference itself: + +| Selector | Result | Why | +| --- | --- | --- | +| `package@1.2.3` | SAFE | Exact semantic version is reproducible. | +| `package` | HIGH | A future resolution can select different package code. | +| `@scope/package` | HIGH | Scoped bare package is still mutable. | +| `package@latest` | HIGH | The selector is explicitly mutable. | +| `package@^1.2.0` | MEDIUM | Resolution can move within the range. | +| `package@~1.2.0` | MEDIUM | Resolution can move within the range. | +| wildcard / inequality / other range | MEDIUM | Selector permits more than one version. | +| local path / script / unknown binary | REVIEW | Package-version drift rules do not establish its update behavior. | + +Treat `-y` / `--yes` only as context. It suppresses interactive confirmation; it is not a vulnerability by itself. + +## Review Workflow + +### 1. Locate repo-scoped configuration + +Check only relevant workspace paths first, for example: + +```text +.mcp.json +.github/mcp.json +.cursor/mcp.json +.vscode/mcp.json +.windsurf/mcp.json +``` + +Also inspect another MCP config path when the user names it explicitly. + +### 2. Parse without executing + +Read JSON or configuration text and identify each configured MCP server. For package-runner invocations such as `npx`, `npm exec`, `bunx`, `bun x`, `pnpm dlx`, or `yarn dlx`, isolate the package selector from command-line flags. + +Never execute the discovered command to learn what it does. + +### 3. Classify the selector + +Apply the static classification table above. If the syntax is ambiguous, return REVIEW rather than guessing. + +### 4. Recommend a reproducible fix + +For mutable selectors, recommend an exact package version that the team has actually reviewed. + +Do **not** invent a pin by substituting today's latest registry version. If the reviewed version is unknown, say so. A registry-history lookup is a separate network operation and should only be performed when the user asks for it. + +### 5. Produce a bounded report + +Use a compact table: + +| Config | MCP server | Package/reference | Result | Why | Next step | +| --- | --- | --- | --- | --- | --- | + +End with these boundaries: + +- No MCP servers were executed during this review. +- Mutable dependency references are reproducibility/review signals, not breach claims. +- A clean result here is not a complete MCP security assessment. + +## Example + +Given: + +```json +{ + "mcpServers": { + "browser": { + "command": "npx", + "args": ["-y", "example-browser-mcp@latest"] + } + } +} +``` + +Report: + +```text +.mcp.json | browser | example-browser-mcp@latest | HIGH +Reason: @latest can resolve to different package code later without a config diff. +Next: pin the exact version the team reviews and update it deliberately. +``` + +## Anti-Patterns + +### Calling every mutable reference a vulnerability + +**Wrong:** `@latest` means the MCP package is compromised. + +**Better:** `@latest` means the configuration does not fully determine which package version will run later. Establish actual security impact separately. + +### Pinning whatever is latest today + +**Wrong:** replace a mutable selector with the current registry version and call the review fixed. + +**Better:** pin a version the team has reviewed. If that evidence is unavailable, record the uncertainty. + +### Expanding scope silently + +**Wrong:** a repo review automatically scans user-level Claude, Cursor, or VS Code configuration. + +**Better:** remain workspace-scoped unless machine-wide review is explicitly requested. + +### Treating a clean drift review as complete MCP security + +Exact dependency pins do not prove safe authorization, prompt-injection resistance, package provenance, secure implementation, or runtime isolation. + +## Related Skills + +- `mcp-server-patterns` — MCP server design, tools, resources, prompts, and transports. +- `security-review` — broader application-security checklist. +- `security-scan` — broader security scanning workflow. + +## Further Reading + +A public reference implementation and reproducible research methodology for this narrow review class are available in [MCP Drift Check](https://github.com/tomelias10/mcp-drift-check). The external project is optional; this ECC skill does not require it to perform the static review.