{"slug": "mcp-security-what-to-check-in-your-mcp-json", "title": "MCP Security: What to Check in Your mcp.json", "summary": "A design flaw in the Model Context Protocol (MCP) STDIO transport passes configuration values directly into shell execution without sanitization, allowing anyone who can influence the config file to execute arbitrary shell commands on the host machine, according to a cybersecurity analysis. The issue is present across the Python, TypeScript, Java, and Rust SDKs and affects tools like claude_desktop_config.json or mcp.json, where inline secrets and commands create a massive attack surface. The author recommends auditing deployments by checking for STDIO servers with inline secrets using a jq command to verify transport methods and credential exposure.", "body_md": "# MCP Security: What to Check in Your mcp.json\n\n`claude_desktop_config.json`\n\nor `mcp.json`\n\nto get your tools running, you're likely running code with a design flaw baked into the reference architecture.The issue is simple: [MCP](/en/tags/mcp/)'s STDIO transport passes configuration values directly into shell execution without sanitization. This means anyone who can influence your config file—via a compromised npm package or a malicious toolchain—can execute arbitrary shell commands on your host machine. This isn't a bug in a single implementation; it's present across the Python, TypeScript, Java, and Rust SDKs.\n\n## The Tool Layer Risk\n\nIn any AI workflow, I view the \"Tools\" layer as the most dangerous. A hallucination in the Model layer gives you a wrong sentence, but a flaw in the Tool layer leads to a wrong action on a live system.\n\nMCP was designed to standardize how models reach outside themselves to hit databases or APIs. While this kills the need for custom integration code, it also kills the manual review process. We've gone from requiring an engineer's sign-off on a custom integration to blindly pasting a JSON block that grants an agent full read/write access to production.\n\nTake this typical config:\n\n```\n{\n \"mcpServers\": {\n \"postgres-prod\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@some/postgres-mcp-server\"], \"env\": {\n \"DATABASE_URL\": \"postgres://user:pass@prod-host:5432/db\" }\n }\n }\n}\n```\n\nThis is a massive attack surface compressed into a few lines of text.\n\n## Practical Audit for Your Config\n\nSince this is a reference architecture decision, you can't just \"update\" it away. You have to audit your own deployment. I've started running a quick check to identify which of my servers are using STDIO with inline secrets.\n\n```\n# crude pass at spotting STDIO servers with inline secrets in your config\njq -r '.mcpServers | to_entries[] | select(.value.command != null) | .key' ~/.config/*/mcp.json 2>/dev/null\n```\n\n*(Note: Adjust the file path based on where your specific client stores the config.)*\n\nThe goal here is to stop trusting a server based on its name and start verifying the transport method and credential exposure for every single entry. If you're using a remote transport with a proper auth boundary, you're in a much better spot than those relying on local STDIO.\n\n[Next Cybersecurity Interview Prep: A Complete Guide →](/en/threads/3171/)", "url": "https://wpnews.pro/news/mcp-security-what-to-check-in-your-mcp-json", "canonical_source": "https://promptcube3.com/en/threads/3211/", "published_at": "2026-07-25 13:47:07+00:00", "updated_at": "2026-07-25 14:06:40.255064+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "developer-tools"], "entities": ["Model Context Protocol", "MCP", "STDIO", "Python", "TypeScript", "Java", "Rust"], "alternates": {"html": "https://wpnews.pro/news/mcp-security-what-to-check-in-your-mcp-json", "markdown": "https://wpnews.pro/news/mcp-security-what-to-check-in-your-mcp-json.md", "text": "https://wpnews.pro/news/mcp-security-what-to-check-in-your-mcp-json.txt", "jsonld": "https://wpnews.pro/news/mcp-security-what-to-check-in-your-mcp-json.jsonld"}}