[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P9BK1DMJVD6QFDG3079TRT":3,"skill-same:01M6P9BK1DMJVD6QFDG3079TRT":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":25,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":37,"commitSha":60,"skillDirectory":61,"forksCount":13,"repositoryHtmlUrl":62,"repositoryHomepageUrl":6,"ownerHtmlUrl":63,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":64,"install":65,"resources":78},"01M6P9BK1DMJVD6QFDG3079TRT","mcp-server-security",null,"Secure Model Context Protocol (MCP) servers with transport encryption, tool authorization, input validation, and audit logging for safe AI agent integrations.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmcp-server-security\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"security","mcp server security","server","MCP","mcp server","only","relevant","Input Validation","scripts","scope","active","main","community","model context protocol","model","devops-security","encryption","audit","assessment","ai agent","2026-11-10 10:12:30",false,"---\nname: mcp-server-security\ndescription: Secure Model Context Protocol (MCP) servers with transport encryption,\n  tool authorization, input validation, and audit logging for safe AI agent integrations.\ncategory: security\nrisk: safe\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant security tooling (scanners, vault CLIs) and an\n  authorized scope for any active assessment. Docs-only; helper scripts and templates\n  not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# MCP Server Security\n\nComprehensive hardening guide for Model Context Protocol (MCP) servers. MCP is the open\nstandard for connecting AI agents to external tools, data sources, and services. Because\nMCP servers execute real actions on real infrastructure, they are a high-value attack\nsurface. This skill covers every layer of defense you need before exposing an MCP server\nto agents in production.\n\n---\n\n## 2. MCP Threat Model\n\nBefore hardening, understand what you are defending against.\n\n| Threat                        | Vector                                                        | Impact                              |\n|-------------------------------|---------------------------------------------------------------|-------------------------------------|\n| Unauthorized tool access      | Agent calls tools the user should not have access to          | Privilege escalation, data breach   |\n| Prompt injection via resources| Malicious content in MCP resources influences agent behavior  | Arbitrary tool execution            |\n| Data exfiltration via results | Tool results leak sensitive data back to an untrusted agent   | Data loss, compliance violation     |\n| SSRF via MCP tools            | Agent tricks a tool into making internal network requests      | Internal service compromise         |\n| Credential theft              | API keys or tokens stored insecurely on the MCP server        | Full account takeover               |\n| Denial of service             | Agent floods server with tool calls or huge payloads          | Service unavailability              |\n| Man-in-the-middle             | Unencrypted transport between agent and MCP server            | Eavesdropping, request tampering    |\n| Supply chain compromise       | Malicious MCP server package or plugin                        | Arbitrary code execution            |\n\n---\n\n## 3. Transport Security\n\n### 3.1 TLS for Streamable HTTP and SSE Transports\n\nEvery MCP server exposed over HTTP must terminate TLS. Never run plain HTTP in\nproduction.\n\n**Nginx reverse proxy with TLS termination for an MCP server:**\n\n```nginx\n# \u002Fetc\u002Fnginx\u002Fsites-enabled\u002Fmcp-server.conf\nserver {\n    listen 443 ssl http2;\n    server_name mcp.internal.example.com;\n\n    ssl_certificate     \u002Fetc\u002Fssl\u002Fcerts\u002Fmcp-server.crt;\n    ssl_certificate_key \u002Fetc\u002Fssl\u002Fprivate\u002Fmcp-server.key;\n    ssl_protocols       TLSv1.3;\n    ssl_ciphers         TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;\n    ssl_prefer_server_ciphers on;\n    ssl_session_timeout 1d;\n    ssl_session_tickets off;\n\n    # HSTS header\n    add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains\" always;\n\n    location \u002F {\n        proxy_pass http:\u002F\u002F127.0.0.1:3001;\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection \"upgrade\";\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-Proto $scheme;\n\n        # SSE-specific: disable buffering so events stream immediately\n        proxy_buffering off;\n        proxy_cache off;\n        proxy_read_timeout 86400s;\n    }\n}\n```\n\n### 3.2 mTLS Between Agent and Server\n\nFor high-security environments, require the agent (client) to present a certificate.\n\n```nginx\n# Add to the server block above\nssl_client_certificate \u002Fetc\u002Fssl\u002Fcerts\u002Fagent-ca.crt;\nssl_verify_client on;\nssl_verify_depth 2;\n```\n\n**Generate a client certificate for an agent:**\n\n```bash\n# Create CA (one-time)\nopenssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 \\\n  -days 365 -noenc -keyout ca-key.pem -out ca-cert.pem \\\n  -subj \"\u002FCN=MCP Agent CA\"\n\n# Create agent client cert signed by the CA\nopenssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 \\\n  -noenc -keyout agent-key.pem -out agent-csr.pem \\\n  -subj \"\u002FCN=agent-orchestrator-01\"\n\nopenssl x509 -req -in agent-csr.pem -CA ca-cert.pem -CAkey ca-key.pem \\\n  -CAcreateserial -out agent-cert.pem -days 90\n```\n\n### 3.3 Securing stdio Transport\n\nFor local stdio-based servers, the attack surface is the process boundary itself:\n\n```jsonc\n\u002F\u002F claude_desktop_config.json - restrict stdio server permissions\n{\n  \"mcpServers\": {\n    \"filesystem\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@modelcontextprotocol\u002Fserver-filesystem\", \"\u002Fhome\u002Fuser\u002Fsafe-dir\"],\n      \"env\": {\n        \"NODE_OPTIONS\": \"--experimental-permission --allow-fs-read=\u002Fhome\u002Fuser\u002Fsafe-dir --allow-fs-write=\u002Fhome\u002Fuser\u002Fsafe-dir\"\n      }\n    }\n  }\n}\n```\n\n---\n\n## 4. Authentication and Authorization\n\n### 4.1 OAuth 2.1 Integration\n\nMCP's Streamable HTTP transport supports OAuth 2.1 for client authentication. Configure\nyour server to validate bearer tokens on every request.\n\n```typescript\n\u002F\u002F src\u002Fauth.ts - OAuth 2.1 token validation middleware for an MCP server\nimport { createServer } from \"@modelcontextprotocol\u002Fsdk\u002Fserver\u002Findex.js\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol\u002Fsdk\u002Fserver\u002FstreamableHttp.js\";\nimport express from \"express\";\nimport jwt from \"jsonwebtoken\";\n\nconst app = express();\n\n\u002F\u002F OAuth 2.1 token validation middleware\nfunction validateBearerToken(req: express.Request, res: express.Response, next: express.NextFunction) {\n  const authHeader = req.headers.authorization;\n  if (!authHeader?.startsWith(\"Bearer \")) {\n    return res.status(401).json({ error: \"missing_token\" });\n  }\n\n  const token = authHeader.slice(7);\n  try {\n    const payload = jwt.verify(token, process.env.OAUTH_PUBLIC_KEY!, {\n      algorithms: [\"RS256\"],\n      issuer: \"https:\u002F\u002Fauth.example.com\",\n      audience: \"mcp-server\",\n    });\n    \u002F\u002F Attach scopes for downstream authorization\n    (req as any).tokenScopes = (payload as any).scope?.split(\" \") || [];\n    (req as any).userId = (payload as any).sub;\n    next();\n  } catch {\n    return res.status(403).json({ error: \"invalid_token\" });\n  }\n}\n\napp.use(\"\u002Fmcp\", validateBearerToken);\n```\n\n### 4.2 API Key Management\n\nFor simpler deployments, use hashed API keys stored server-side:\n\n```typescript\n\u002F\u002F src\u002Fapikeys.ts\nimport { createHash, timingSafeEqual } from \"crypto\";\n\ninterface ApiKeyRecord {\n  hashedKey: string;\n  userId: string;\n  allowedTools: string[];\n  rateLimit: number;        \u002F\u002F requests per minute\n  expiresAt: Date;\n}\n\n\u002F\u002F Store hashed keys, never plaintext\nconst apiKeyStore: Map\u003Cstring, ApiKeyRecord> = new Map();\n\nexport function registerApiKey(plainKey: string, record: Omit\u003CApiKeyRecord, \"hashedKey\">) {\n  const hashed = createHash(\"sha256\").update(plainKey).digest(\"hex\");\n  apiKeyStore.set(hashed, { ...record, hashedKey: hashed });\n}\n\nexport function validateApiKey(plainKey: string): ApiKeyRecord | null {\n  const hashed = createHash(\"sha256\").update(plainKey).digest(\"hex\");\n  const record = apiKeyStore.get(hashed);\n  if (!record) return null;\n  if (new Date() > record.expiresAt) {\n    apiKeyStore.delete(hashed);\n    return null;\n  }\n  return record;\n}\n```\n\n---\n\n## 5. Tool Authorization\n\n### 5.1 Allowlist Patterns\n\nNever expose every tool to every user. Define an explicit allowlist:\n\n```yaml\n# config\u002Ftool-policy.yaml\npolicies:\n  - role: developer\n    allowed_tools:\n      - \"read_file\"\n      - \"search_code\"\n      - \"run_tests\"\n    denied_tools:\n      - \"execute_command\"\n      - \"write_file\"\n      - \"delete_file\"\n\n  - role: admin\n    allowed_tools: [\"*\"]\n    denied_tools: []\n\n  - role: readonly-agent\n    allowed_tools:\n      - \"read_file\"\n      - \"list_directory\"\n      - \"query_database:SELECT\"\n    denied_tools: [\"*\"]\n\ndangerous_tools:\n  - name: \"execute_command\"\n    risk: critical\n    requires_approval: true\n    max_executions_per_session: 5\n  - name: \"write_file\"\n    risk: high\n    requires_approval: true\n  - name: \"query_database\"\n    risk: medium\n    allowed_operations: [\"SELECT\"]\n```\n\n### 5.2 Per-User Tool Access Enforcement\n\n```typescript\n\u002F\u002F src\u002FtoolAuth.ts\nimport { readFileSync } from \"fs\";\nimport { parse } from \"yaml\";\n\ninterface ToolPolicy {\n  role: string;\n  allowed_tools: string[];\n  denied_tools: string[];\n}\n\nconst config = parse(readFileSync(\"config\u002Ftool-policy.yaml\", \"utf-8\"));\nconst policies: ToolPolicy[] = config.policies;\n\nexport function isToolAllowed(userRole: string, toolName: string): boolean {\n  const policy = policies.find((p) => p.role === userRole);\n  if (!policy) return false;\n\n  \u002F\u002F Explicit deny takes precedence\n  if (policy.denied_tools.includes(toolName)) return false;\n  if (policy.denied_tools.includes(\"*\") && !policy.allowed_tools.includes(toolName)) return false;\n\n  \u002F\u002F Check allow\n  if (policy.allowed_tools.includes(\"*\")) return true;\n  if (policy.allowed_tools.includes(toolName)) return true;\n\n  return false;\n}\n\n\u002F\u002F MCP server integration: wrap the tool handler\nexport function authorizedToolHandler(server: any) {\n  const originalCallTool = server.callTool.bind(server);\n\n  server.callTool = async (request: any, context: any) => {\n    const userRole = context.session?.userRole || \"readonly-agent\";\n    const toolName = request.params.name;\n\n    if (!isToolAllowed(userRole, toolName)) {\n      return {\n        content: [{ type: \"text\", text: `Access denied: tool \"${toolName}\" is not permitted for role \"${userRole}\".` }],\n        isError: true,\n      };\n    }\n    return originalCallTool(request, context);\n  };\n}\n```\n\n---\n\n\n## Contents\n\n- [6. Input Validation](references\u002Fdetails.md)\n- [7. Resource Access Control](references\u002Fdetails.md)\n- [8. Rate Limiting](references\u002Fdetails.md)\n- [9. Audit Logging](references\u002Fdetails.md)\n- [10. Deployment Hardening](references\u002Fdetails.md)\n- [11. Testing](references\u002Fdetails.md)\n- [Quick Reference Checklist](references\u002Fdetails.md)\n\n## When to Use This Skill\n\nApply this skill whenever you are:\n\n- Deploying an MCP server that exposes tools (filesystem, database, API) to AI agents.\n- Connecting an agent runtime (Claude Desktop, Cursor, a custom orchestrator) to one or\n  more MCP servers over stdio, SSE, or Streamable HTTP transport.\n- Building a multi-tenant platform where multiple users share the same MCP server.\n- Passing sensitive data (PII, credentials, internal documents) through MCP resources.\n- Operating in a regulated environment (SOC 2, HIPAA, PCI-DSS) where tool invocations\n  must be auditable.\n\nIf your MCP server only runs locally over stdio for a single developer with no network\nexposure, you can relax some transport-layer controls -- but input validation and audit\nlogging still apply.\n\n---\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# MCP Server Security\n\nComprehensive hardening guide for Model Context Protocol (MCP) servers. MCP is the open\nstandard for connecting AI agents to external tools, data sources, and services. Because\nMCP servers execute real actions on real infrastructure, they are a high-value attack\nsurface. This skill covers every layer of defense you need before exposing an MCP server\nto agents in production.\n\n---\n\n## 2. MCP Threat Model\n\nBefore hardening, understand what you are defending against.\n\n| Threat                        | Vector                                                        | Impact                              |\n|-------------------------------|---------------------------------------------------------------|-------------------------------------|\n| Unauthorized tool access      | Agent calls tools the user should not have access to          | Privilege escalation, data breach   |\n| Prompt injection via resources| Malicious content in MCP resources influences agent behavior  | Arbitrary tool execution            |\n| Data exfiltration via results | Tool results leak sensitive data back to an untrusted agent   | Data loss, compliance violation     |\n| SSRF via MCP tools            | Agent tricks a tool into making internal network requests      | Internal service compromise         |\n| Credential theft              | API keys or tokens stored insecurely on the MCP server        | Full account takeover               |\n| Denial of service             | Agent floods server with tool calls or huge payloads          | Service unavailability              |\n| Man-in-the-middle             | Unencrypted transport between agent and MCP server            | Eavesdropping, request tampering    |\n| Supply chain compromise       | Malicious MCP server package or plugin                        | Arbitrary code execution            |\n\n---\n\n## 3. Transport Security\n\n### 3.1 TLS for Streamable HTTP and SSE Transports\n\nEvery MCP server exposed over HTTP must terminate TLS. Never run plain HTTP in\nproduction.\n\n**Nginx reverse proxy with TLS termination for an MCP server:**\n\n```nginx\n# \u002Fetc\u002Fnginx\u002Fsites-enabled\u002Fmcp-server.conf\nserver {\n    listen 443 ssl http2;\n    server_name mcp.internal.example.com;\n\n    ssl_certificate     \u002Fetc\u002Fssl\u002Fcerts\u002Fmcp-server.crt;\n    ssl_certificate_key \u002Fetc\u002Fssl\u002Fprivate\u002Fmcp-server.key;\n    ssl_protocols       TLSv1.3;\n    ssl_ciphers         TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;\n    ssl_prefer_server_ciphers on;\n    ssl_session_timeout 1d;\n    ssl_session_tickets off;\n\n    # HSTS header\n    add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains\" always;\n\n    location \u002F {\n        proxy_pass http:\u002F\u002F127.0.0.1:3001;\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection \"upgrade\";\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-Proto $scheme;\n\n        # SSE-specific: disable buffering so events stream immediately\n        proxy_buffering off;\n        proxy_cache off;\n        proxy_read_timeout 86400s;\n    }\n}\n```\n\n### 3.2 mTLS Between Agent and Server\n\nFor high-security environments, require the agent (client) to present a certificate.\n\n```nginx\n# Add to the server block above\nssl_client_certificate \u002Fetc\u002Fssl\u002Fcerts\u002Fagent-ca.crt;\nssl_verify_client on;\nssl_verify_depth 2;\n```\n\n**Generate a client certificate for an agent:**\n\n```bash\n# Create CA (one-time)\nopenssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 \\\n  -days 365 -noenc -keyout ca-key.pem -out ca-cert.pem \\\n  -subj \"\u002FCN=MCP Agent CA\"\n\n# Create agent client cert signed by the CA\nopenssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 \\\n  -noenc -keyout agent-key.pem -out agent-csr.pem \\\n  -subj \"\u002FCN=agent-orchestrator-01\"\n\nopenssl x509 -req -in agent-csr.pem -CA ca-cert.pem -CAkey ca-key.pem \\\n  -CAcreateserial -out agent-cert.pem -days 90\n```\n\n### 3.3 Securing stdio Transport\n\nFor local stdio-based servers, the attack surface is the process boundary itself:\n\n```jsonc\n\u002F\u002F claude_desktop_config.json - restrict stdio server permissions\n{\n  \"mcpServers\": {\n    \"filesystem\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@modelcontextprotocol\u002Fserver-filesystem\", \"\u002Fhome\u002Fuser\u002Fsafe-dir\"],\n      \"env\": {\n        \"NODE_OPTIONS\": \"--experimental-permission --allow-fs-read=\u002Fhome\u002Fuser\u002Fsafe-dir --allow-fs-write=\u002Fhome\u002Fuser\u002Fsafe-dir\"\n      }\n    }\n  }\n}\n```\n\n---\n\n## 4. Authentication and Authorization\n\n### 4.1 OAuth 2.1 Integration\n\nMCP's Streamable HTTP transport supports OAuth 2.1 for client authentication. Configure\nyour server to validate bearer tokens on every request.\n\n```typescript\n\u002F\u002F src\u002Fauth.ts - OAuth 2.1 token validation middleware for an MCP server\nimport { createServer } from \"@modelcontextprotocol\u002Fsdk\u002Fserver\u002Findex.js\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol\u002Fsdk\u002Fserver\u002FstreamableHttp.js\";\nimport express from \"express\";\nimport jwt from \"jsonwebtoken\";\n\nconst app = express();\n\n\u002F\u002F OAuth 2.1 token validation middleware\nfunction validateBearerToken(req: express.Request, res: express.Response, next: express.NextFunction) {\n  const authHeader = req.headers.authorization;\n  if (!authHeader?.startsWith(\"Bearer \")) {\n    return res.status(401).json({ error: \"missing_token\" });\n  }\n\n  const token = authHeader.slice(7);\n  try {\n    const payload = jwt.verify(token, process.env.OAUTH_PUBLIC_KEY!, {\n      algorithms: [\"RS256\"],\n      issuer: \"https:\u002F\u002Fauth.example.com\",\n      audience: \"mcp-server\",\n    });\n    \u002F\u002F Attach scopes for downstream authorization\n    (req as any).tokenScopes = (payload as any).scope?.split(\" \") || [];\n    (req as any).userId = (payload as any).sub;\n    next();\n  } catch {\n    return res.status(403).json({ error: \"invalid_token\" });\n  }\n}\n\napp.use(\"\u002Fmcp\", validateBearerToken);\n```\n\n### 4.2 API Key Management\n\nFor simpler deployments, use hashed API keys stored server-side:\n\n```typescript\n\u002F\u002F src\u002Fapikeys.ts\nimport { createHash, timingSafeEqual } from \"crypto\";\n\ninterface ApiKeyRecord {\n  hashedKey: string;\n  userId: string;\n  allowedTools: string[];\n  rateLimit: number;        \u002F\u002F requests per minute\n  expiresAt: Date;\n}\n\n\u002F\u002F Store hashed keys, never plaintext\nconst apiKeyStore: Map\u003Cstring, ApiKeyRecord> = new Map();\n\nexport function registerApiKey(plainKey: string, record: Omit\u003CApiKeyRecord, \"hashedKey\">) {\n  const hashed = createHash(\"sha256\").update(plainKey).digest(\"hex\");\n  apiKeyStore.set(hashed, { ...record, hashedKey: hashed });\n}\n\nexport function validateApiKey(plainKey: string): ApiKeyRecord | null {\n  const hashed = createHash(\"sha256\").update(plainKey).digest(\"hex\");\n  const record = apiKeyStore.get(hashed);\n  if (!record) return null;\n  if (new Date() > record.expiresAt) {\n    apiKeyStore.delete(hashed);\n    return null;\n  }\n  return record;\n}\n```\n\n---\n\n## 5. Tool Authorization\n\n### 5.1 Allowlist Patterns\n\nNever expose every tool to every user. Define an explicit allowlist:\n\n```yaml\n# config\u002Ftool-policy.yaml\npolicies:\n  - role: developer\n    allowed_tools:\n      - \"read_file\"\n      - \"search_code\"\n      - \"run_tests\"\n    denied_tools:\n      - \"execute_command\"\n      - \"write_file\"\n      - \"delete_file\"\n\n  - role: admin\n    allowed_tools: [\"*\"]\n    denied_tools: []\n\n  - role: readonly-agent\n    allowed_tools:\n      - \"read_file\"\n      - \"list_directory\"\n      - \"query_database:SELECT\"\n    denied_tools: [\"*\"]\n\ndangerous_tools:\n  - name: \"execute_command\"\n    risk: critical\n    requires_approval: true\n    max_executions_per_session: 5\n  - name: \"write_file\"\n    risk: high\n    requires_approval: true\n  - name: \"query_database\"\n    risk: medium\n    allowed_operations: [\"SELECT\"]\n```\n\n### 5.2 Per-User Tool Access Enforcement\n\n```typescript\n\u002F\u002F src\u002FtoolAuth.ts\nimport { readFileSync } from \"fs\";\nimport { parse } from \"yaml\";\n\ninterface ToolPolicy {\n  role: string;\n  allowed_tools: string[];\n  denied_tools: string[];\n}\n\nconst config = parse(readFileSync(\"config\u002Ftool-policy.yaml\", \"utf-8\"));\nconst policies: ToolPolicy[] = config.policies;\n\nexport function isToolAllowed(userRole: string, toolName: string): boolean {\n  const policy = policies.find((p) => p.role === userRole);\n  if (!policy) return false;\n\n  \u002F\u002F Explicit deny takes precedence\n  if (policy.denied_tools.includes(toolName)) return false;\n  if (policy.denied_tools.includes(\"*\") && !policy.allowed_tools.includes(toolName)) return false;\n\n  \u002F\u002F Check allow\n  if (policy.allowed_tools.includes(\"*\")) return true;\n  if (policy.allowed_tools.includes(toolName)) return true;\n\n  return false;\n}\n\n\u002F\u002F MCP server integration: wrap the tool handler\nexport function authorizedToolHandler(server: any) {\n  const originalCallTool = server.callTool.bind(server);\n\n  server.callTool = async (request: any, context: any) => {\n    const userRole = context.session?.userRole || \"readonly-agent\";\n    const toolName = request.params.name;\n\n    if (!isToolAllowed(userRole, toolName)) {\n      return {\n        content: [{ type: \"text\", text: `Access denied: tool \"${toolName}\" is not permitted for role \"${userRole}\".` }],\n        isError: true,\n      };\n    }\n    return originalCallTool(request, context);\n  };\n}\n```\n\n---\n\n\n## Contents\n\n- [6. Input Validation](references\u002Fdetails.md)\n- [7. Resource Access Control](references\u002Fdetails.md)\n- [8. Rate Limiting](references\u002Fdetails.md)\n- [9. Audit Logging](references\u002Fdetails.md)\n- [10. Deployment Hardening](references\u002Fdetails.md)\n- [11. Testing](references\u002Fdetails.md)\n- [Quick Reference Checklist](references\u002Fdetails.md)\n\n## When to Use This Skill\n\nApply this skill whenever you are:\n\n- Deploying an MCP server that exposes tools (filesystem, database, API) to AI agents.\n- Connecting an agent runtime (Claude Desktop, Cursor, a custom orchestrator) to one or\n  more MCP servers over stdio, SSE, or Streamable HTTP transport.\n- Building a multi-tenant platform where multiple users share the same MCP server.\n- Passing sensitive data (PII, credentials, internal documents) through MCP resources.\n- Operating in a regulated environment (SOC 2, HIPAA, PCI-DSS) where tool invocations\n  must be auditable.\n\nIf your MCP server only runs locally over stdio for a single developer with no network\nexposure, you can relax some transport-layer controls -- but input validation and audit\nlogging still apply.\n\n---\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":51,"source":52,"license":14,"category":26,"metadata":53,"date_added":56,"description":7,"source_repo":57,"source_type":38,"compatibility":58,"license_source":59},"safe","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills",{"author":54,"version":55},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant security tooling (scanners, vault CLIs) and an authorized scope for any active assessment. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fmcp-server-security","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill mcp-server-security",{"tool":71,"command":72},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill mcp-server-security",{"tool":74,"command":75},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill mcp-server-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmcp-server-security\u002FSKILL.md",true,[79],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fdetails.md","REFERENCE","参考文档",20371,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmcp-server-security\u002Freferences\u002Fdetails.md",[86,106,129,153,179,203],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":95,"publishedAt":46},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[92],{"categoryNo":93,"categoryName":94,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署",[96,97,98,99,44,100,88,101,41,102,103,31,38,37,36,104,35,34,32,105],"ZeRO","trust","zero trust","architecture","verification","segmentation","access","configure","critical","implementing",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":46},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[113,114,115,116,117,118,119,120,121,40,122,123,124,31,125,38,126,127,104,128],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":46},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[136,137,138,51,139,140,141,142,143,144,145,146,147,38,37,148,149,150,151,152],"transcript","youtube transcript","youtube","github","codex","research","license","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":168,"publishedAt":46},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[159,160,163],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":161,"categoryName":162,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":164,"categoryName":165,"taxonomyType":166,"taxonomyTypeDesc":167},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[136,137,138,169,51,170,139,140,142,171,172,173,174,145,175,38,37,176,177,178],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":189,"publishedAt":46},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[185,188],{"categoryNo":186,"categoryName":187,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":161,"categoryName":162,"taxonomyType":20,"taxonomyTypeDesc":21},[138,190,191,117,51,192,193,194,195,142,173,196,197,198,199,37,200,148,201,202],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":46},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[209],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[211,138,212,213,51,170,171,28,214,172,173,174,145,215,175,38,37,176,216,151],"youtube full","full","google","dlp","credits","automatic"]