Skippy's MCP
About

MCP Security Playbook (Read This, Monkeys)

Listen, monkeys: MCP is a trust machine. These threats are not theoretical — they are what happens when you skip chapters and ship anyway.

Threat: tool poisoning via descriptions

Poisoned metadata flows into planner context.

Mitigation

Allowlist servers, review diffs, separate trust tiers, strip or summarize tool metadata for planners.

Threat: path traversal in tools

User/model input reaches filesystem without jail.

Mitigation

path.resolve, enforce root, reject .., deny symlinks escaping root.

Threat: SSRF from HTTP MCP tools

Mitigation

Block private IPs, validate URLs, require explicit egress allowlists per tool.

Threat: secrets in tool outputs

Mitigation

Redact patterns, structured logging, never echo env wholesale.