AI Blocks › Keep your code secure
MCP attack defence reviewer
Point it at an MCP server. Get a ranked list of attack risks, each with a fix.
MCP attack defence reviewer is a free AI skill for the job "Keep your code secure". Give the instructions to an AI assistant that supports the required files and tools, then review its output.
Free · No account · MIT licence · Made by Paldom · Level: expert · Thinking: high
Made by Paldom. See the original on GitHub; we copied it as it is, with its licence.
What it does
A ranked list of the ways someone could attack your MCP server, with a fix for each. Point it at the server and see where an attacker or a confused AI could do damage. It starts with a threat model built on the known MCP attack types. The core idea is that protections must live in code, not in the prompt, since prompts can be talked around. It looks for tools that change data without a retry guard, checks how far a single compromised call can reach, and checks that logs cannot be tampered with. It also cleans what the model sees, such as tool descriptions and results, where hidden instructions can hide.
You give it
- The MCP server code or repo
- The tools it exposes
- What data and systems it can reach
You get
- A ranked list of risks
- A fix for each risk
- Code guard suggestions
- A logging plan
- CI checks
Use it when
- You are about to give an AI access to your MCP server and want it checked.
- A tool result could contain text that tricks the AI.
- Your server can delete or pay and you worry about retries.
- You need a security list to show before release.
How to use it
- Add it to your AI once: download it and add the folder to Claude, ChatGPT or Codex as a skill.
- Ask for the job in your own words. Your AI opens the skill when it fits.
- It works best when your AI can read your code.