pentesting-mcp-servers-checklist
A practical, community-driven checklist for pentesting MCP servers. Covers traffic analysis, tool-call behavior, namespace abuse, auth flows, and remote server risks. Maintained by Appsecco and licensed for remixing.
Install / Use
claude mcp add appsecco -- npx -y github:appsecco/pentesting-mcp-servers-checklistIf the server publishes to npm under a different name, use that package instead — check the repo README.
MCP Server
Model Context Protocol server
Quality Score
Category
SecuritySupported Platforms
Our assessment of pentesting-mcp-servers-checklist
pentesting-mcp-servers-checklist scores 69/100 on our quality scale, 1074th of 1,130 Security skills we index.
Its MCP Server is 2.7 KB long, split into 7 sections and no code examples: a solid amount of guidance for an agent.
It has 42 GitHub stars, so there is little community track record yet; judge it on its content.
Maintenance, license and trust
- The repository was last updated about 7 months ago. That is recent enough to be usable, but agent tooling moves fast, so check the instructions against your agent's current version.
- It is released under the CC-BY-4.0 license; check its terms before commercial use.
- Its trust signals score 91/100, with 1 caution from licensing, adoption, age or documentation. These come from repository metadata, not a code audit — read the skill file before letting an agent act on it.
Safety scan
No issues foundOur scan of the whole file found no instruction hijacking, hidden characters, credential access, data exfiltration or destructive commands.
Automated pattern scan on 2026-10-23. It catches known dangerous patterns, not every risk — read a skill before letting an agent act on it.
pentesting-mcp-servers-checklist compared with similar skills
All 4 of these similar skills score higher than pentesting-mcp-servers-checklist; compare them before choosing.
| Skill | Score | Stars | Updated | Format |
|---|---|---|---|---|
| pentesting-mcp-servers-checklist (this skill)by appsecco | 69 | 42 | 7mo ago | MCP Server |
| Agent-Reachby Panniantong | 100 | 101.0k | 2d ago | CLAUDE.md |
| headroomby headroomlabs-ai | 100 | 77.5k | today | CLAUDE.md |
| CowAgentby zhayujie | 100 | 47.5k | today | CLAUDE.md |
| Scraplingby D4Vinci | 100 | 89.2k | today | MCP Server |
Frequently asked questions
- How do I install pentesting-mcp-servers-checklist?
- Run
claude mcp add appsecco -- npx -y github:appsecco/pentesting-mcp-servers-checklist. The install tabs above show the steps for each supported agent. - Which AI agents does pentesting-mcp-servers-checklist work with?
- It is written for Claude Code and Claude Desktop, as a MCP Server file. Other agents that read the same format can often use it too.
- Is pentesting-mcp-servers-checklist safe to use?
- Our scan of the whole file found no instruction hijacking, hidden characters, credential access, data exfiltration or destructive commands. It is CC-BY-4.0-licensed and scores 91/100 on trust signals. Skills are instructions an agent will follow, so read the file before installing it and do not approve commands you do not understand.
- Is pentesting-mcp-servers-checklist still maintained?
- The repository was last updated about 7 months ago. That is recent enough to be usable, but agent tooling moves fast, so check the instructions against your agent's current version.
Skill content
View source on GitHubREADME
Version 3 is out now!
A practical, community-driven checklist for pentesting Model Context Protocol (MCP) servers. This guide covers local and remote MCP server risks, traffic analysis, tool-call behaviors, context boundaries, authorization flows, and unsafe code paths.
Originally created for the OWASP Bay Area talk on Pentesting MCP Servers (Oct 2025), this checklist is designed for practitioners performing assessments on MCP-based tools, agents, and integrations.
Why this exists
MCP servers are becoming the new execution layer for AI agents. This means they expose:
- File system access
- Tool execution
- Remote APIs
- STDIO and HTTP bridges
- Autonomous actions initiated by LLMs
Because of this, MCP servers introduce a wide attack surface that security testers need structured guidance for. This checklist helps you perform systematic and repeatable assessments.
What this checklist covers
- Traffic Analysis — proxy inspection of STDIO/HTTP, context injection, TLS enforcement
- Authentication & Authorization — auth bypass, OAuth flows, IDOR, privilege escalation
- Local MCP Server File and Code Review — embedded secrets, dangerous functions, dependency audits
- MCP Tool Behavior and Functionality — tool boundary validation, chaining, local RCE
- Tool Security — Input Validation — command injection, path traversal, SSRF, SQLi, SSTI
- Tool Security — Output & Schema Validation — schema mismatches, sensitive data leakage, prompt injection via output
- Tool Injection — prompt injection via tool names/descriptions, tool shadowing, name collisions
- File System & Network Access — path traversal, scope enforcement, DNS rebinding
- Context Isolation — cross-user leakage, namespace separation, session persistence
- Secret & Credential Handling — hardcoded secrets, log exposure, token caching
- Logging & Monitoring — log injection, rate limiting, access controls
- Race Conditions & Concurrency — TOCTOU, parallel invocation, resource exhaustion
- Advanced Attacks — context pollution, confused deputy, prototype pollution, GraphQL injection
How to use this repo
- Use the CHECKLIST.md for field assessments
- Fork and adapt it for your team
- Submit PRs with improvements
- Open issues for new MCP attack patterns
Contribute
We welcome:
- New checklist items
- Additional MCP server categories
- Tooling contributions
- Red-team test cases
- Sanitized findings
License
This project is licensed under CC BY 4.0. You may remix, adapt, and build upon this checklist for any purpose, even commercially, as long as you provide attribution.
Maintainers
Appsecco
- https://appsecco.com
- https://youtube.com/@appsecco
Related Skills
Agent-Reach
101.0kGive your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees.
headroom
77.5kCompress tool outputs, logs, files, and RAG chunks before they reach the LLM. 20% fewer tokens for coding agents, 60-95% fewer tokens for JSON, same answers. Library, proxy, MCP server.
CowAgent
47.5kOpen-source personal AI assistant & Agent Harness. Plans tasks, runs tools and skills, self-evolves with memory and knowledge. Multi-agent, multi-model, multi-channel. Lightweight, extensible, one-line install.
Scrapling
89.2k🕷️ A Web Scraping framework that handles everything from a single request to a full-scale crawl! Don't be shy, join here: https://discord.gg/EMgGbDceNQ and follow here for daily tips and tricks: https://x.com/Scrapling_dev
Trust signals
From repository metadata: license, adoption, age and documentation. Not a code audit — see the Safety scan above for what the skill file itself contains.