mcp-audit-skill

Claude skill for systematic audits of MCP servers against a curated corpus of best-practice standards. 112 checks, 12 categories, on a dual spec baseline (2025-11-25 and 2026-07-28), with a Swiss compliance layer for public administration and a data-fidelity layer for data-source servers.

🇩🇪 Deutsche Version

---

What it is: a Claude skill that audits MCP servers systematically against published best practices. Every check references its source, has clear pass criteria, a remediation path and an effort indicator.

What it is not: not an automated code scanner, not a vulnerability tool, not a compliance stamp. The skill makes the methodology reproducible — architectural judgement stays human.

Architecture model

The checks follow the five-layer security model established as the consensus architecture in the MCP security community. Each layer validates on its own — none trusts the one above it blindly.

┌────────────────────────────────────────────────────────┐
│  LLM host (Claude, ChatGPT, Cursor)                    │
│  Untrusted: may carry prompt injections                │
└────────────────────────┬───────────────────────────────┘
                         │
┌────────────────────────▼───────────────────────────────┐
│  MCP gateway / policy layer                            │
│  Rate limit · audit log · DLP · tool allow-list        │
└────────────────────────┬───────────────────────────────┘
                         │
┌────────────────────────▼───────────────────────────────┐
│  Authentication & authorisation                        │
│  OAuth 2.1 + PKCE · resource indicators · scopes       │
└────────────────────────┬───────────────────────────────┘
                         │
┌────────────────────────▼───────────────────────────────┐
│  MCP server logic                                      │
│  Input validation · schema · idempotency · sandbox     │
└────────────────────────┬───────────────────────────────┘
                         │
┌────────────────────────▼───────────────────────────────┐
│  Data source / backend                                 │
│  Read-only service account · least privilege           │
└────────────────────────────────────────────────────────┘

SOLID for MCP servers

The five principles the whole check catalogue is aligned to:

Principle	Meaning	Key checks
Sandbox	Every server in Docker / WASM with an egress filter	SEC-007, SEC-021
OAuth 2.1	OAuth instead of API keys, with PKCE and resource indicators	SEC-001, SEC-002, SEC-003
Least privilege	Keep service-account rights minimal	SEC-003, SEC-013
Idempotency	Idempotency keys plus compensating actions on every write	ARCH-010
Defense-in-depth	Gateway + auth + schema + sandbox + DLP, stacked	SCALE-005, SEC-018, SEC-023

Cover all five and you are protected against roughly 80% of the attack classes observed today. The remaining ~20% — primarily prompt injection at the tool-description level — is structurally unsolved and needs organisational controls (human-in-the-loop, threat detection, audit reviews).

Anchor demo