mcpsec is a specialized security auditing tool that scans Model Context Protocol (MCP) server configurations for vulnerabilities based on the OWASP MCP Top 10.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install mcpsec-skill
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install mcpsec-skill using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is mcpsec?
The mcpsec skill is a vital utility for developers and security researchers working with the Model Context Protocol. It provides a robust framework for identifying security gaps in AI agent tool configurations, ensuring that your Openclaw Skills are protected against common attack vectors. The tool is designed to be read-only, meaning it analyzes your configuration files without ever modifying them, providing a safe way to audit environments like Claude Desktop, Cursor, and VS Code.
By leveraging the mcpsec binary, this skill automates the detection of risks such as hardcoded API keys, insecure transport protocols, and prompt injection vulnerabilities in tool descriptions. It acts as a proactive defense layer, allowing users to maintain a strong security posture while building and deploying advanced AI integrations.
mcpsec Use Cases
- Identifying hardcoded secrets and API tokens within environment variables of Openclaw Skills.
- Detecting potential prompt injection vulnerabilities in tool descriptions before deployment.
- Auditing tool permission sets to ensure compliance with the principle of least privilege.
- Verifying that MCP servers are using secure transport protocols like HTTPS/TLS.
- Automating security checks within local development workflows for Cursor and VS Code users.
How mcpsec Works
- The skill initiates by auto-discovering standard MCP configuration paths on the local filesystem.
- It executes the mcpsec Go binary to parse the identified JSON configuration files.
- Each tool and server definition is analyzed against the OWASP MCP Top 10 security risk categories.
- The wrapper script processes the binary's output to filter by user-defined severity levels (Critical, High, Medium, Low).
- A comprehensive security report is generated, highlighting specific risks and offering actionable insights for remediation.
mcpsec Setup
To use this skill with your Openclaw Skills, you must first install the mcpsec binary. On macOS, you can use Homebrew:
brew install pfrederiksen/tap/mcpsec
For Linux users, download the binary and verify the SHA256 checksum for security:
curl -L https://github.com/pfrederiksen/mcpsec/releases/download/v1.0.0/mcpsec_1.0.0_linux_amd64.tar.gz -o mcpsec.tar.gz
# Verify checksum (e367cce4...)
tar -xzf mcpsec.tar.gz && mv mcpsec /usr/local/bin/mcpsec
Ensure Python 3.10+ is installed to run the provided scanning scripts.
mcpsec Data Schema & Taxonomy
The mcpsec skill scans standard JSON configuration files. It specifically looks for data structures corresponding to these IDEs and environments:
| Environment | Config Path |
|---|---|
| Claude Desktop | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Cursor | ~/.cursor/mcp.json |
| VS Code | ~/.vscode/mcp.json |
| Custom Openclaw | ~/.openclaw/workspace/mcp-config.json |
The scanner evaluates keys such as mcpServers, env, and tools within these files.
mcpsec Advanced Features
- Multi-environment support: Automatically scans Claude, Cursor, and VS Code configurations in one pass.
- Granular severity filtering: Use flags to isolate critical and high-priority risks for rapid response.
- JSON output mode: Enables integration with SIEM platforms, dashboards, or automated security pipelines for Openclaw Skills.
- Quiet mode execution: Perfect for silent background audits via cron or other task schedulers.
- Detailed OWASP Mapping: Every finding is mapped to a specific MCP risk ID (e.g., MCP01 for Prompt Injection) for better developer education.
SKILL.md
Loading
Related Openclaw Skills
GHIN Golf Tracker
A local analysis tool for processing GHIN golf data to track handicap trends, scoring patterns, and course performance.
Email Intelligence
A smart email analysis tool that transforms inbox clutter into actionable health metrics using weather metaphors and debt scoring.
Arccos Golf Performance Analyzer
Analyze your Arccos Golf performance data, including strokes gained and club distances, through a powerful command-line interface.
Amazon Orders Skill
A robust tool for downloading and querying Amazon order history through an unofficial Python API and CLI interface.
OpenClaw Update Checker
A read-only utility to compare the currently installed OpenClaw version against the latest release on the npm registry.
Photo Edit Analysis
An expert-level AI skill for providing professional, editorial-grade feedback on photographic composition and post-processing quality.
METADATA
Featured*
