Hire an AI MCP server release reviewer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• Code and settings findings
• Protocol test report
• Release blockers and limits

How it does the job well

• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: You are about to release an MCP server and want it checked first.

• Handler security review. Risks traced through each tool handler, with file and line, evidence and a fix.
• Settings risk findings. Findings rated CRITICAL, HIGH or MEDIUM, such as stored secrets or loose package versions.
• Protocol test report. A real session check of tools, resources, prompts, error cases and advertised features.
• Release blockers and limits. What must be fixed before release and what could not be checked.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• MCP handler security reviewer. Share your MCP code. Get risks traced through tool handlers, with evidence and fixes.
• MCP settings risk checker. Share your MCP settings. Get risks in permissions, trust and server access, with fixes.
• MCP protocol release tester. Share your MCP server. Get a real session check of its tools, errors and advertised features.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id verify-an-mcp-server-release only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/verify-an-mcp-server-release/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• Your MCP server code
• Your settings file, such as .mcp.json
• How the server is reached, on your machine only or over a network
• A way to start the server for a test session

Functions and deliverables

• MCP server release reviewer: Share the MCP server, settings and test access. Get code and permission findings, actual protocol-test results and a clear release-blocker list.
  • Code and settings findings
  • Protocol test report
  • Release blockers and limits
• MCP handler security reviewer: Review your MCP server code for security gaps. Get a report of risks in each tool handler, with file and line evidence and fixes.
  • A summary of what you shared: server or client, transport and protocol version
  • A pass, fail or needs-investigation status for each baseline control, with file and line evidence
  • A check of remote code execution risks in your tool handlers
  • A check against the OWASP MCP Top 10
  • A list of manual follow-ups, with a fix for each risk
  Source: GitHub Copilot community.
• MCP settings risk checker: Share MCP server settings. Get static checks for exposed secrets, shell patterns and changing package versions, with proposed fixes.
  • A count of servers scanned and findings by severity
  • Any secrets typed straight into the file, with a safer way to store them
  • Risky command patterns in server arguments
  • Packages without an exact reviewed version
  • A fix for every finding
  • Next steps: fix the flagged lines, pin reviewed versions, then run the check again before you commit
  Source: GitHub Copilot community.
• MCP protocol release tester: Test your MCP server before release. Get a real session check of its tools, errors and docs, with exact commands and a clear pass or fail.
  • A header with the commit tested, the transport used and a verdict of PASS, PASS WITH CAVEATS or FAIL
  • Each exact command that ran, with its result
  • A transcript of one full session, including bad-input tests
  • A table comparing tools, resources and prompts across code, live server, package details and docs
  • Findings with severity, evidence and the smallest fix, plus a Missing evidence list
  Source: GitHub Copilot community.
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• You are about to release an MCP server and want it checked first.
• You changed a server's tools or settings and want to know if it is still safe.
• You want a real test session, not only a code read.

Limits to check before starting

• You want to build the server, not check it: use API-to-MCP server release builder.
• You only want to run tests against a server: use MCP server test runner.
• You want to fix the holes it finds in the server: use MCP server security reviewer.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Add the complete skill pack to an AI that can run commands and start your server.
• Share the server code, the settings file and how to start the server. Use test data and a test environment.
• Ask it to follow the steps and mark any missing facts. If it cannot start the server, step 3 is marked not run.
• Review the findings and fix the blockers before you release.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/verify-an-mcp-server-release for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.