Skip to content

Expand /safetycheck from 8 to 20 checks — full MCP security suite#2

Merged
fidgetcoding merged 1 commit into
mainfrom
feature/safetycheck-20-checks
Apr 5, 2026
Merged

Expand /safetycheck from 8 to 20 checks — full MCP security suite#2
fidgetcoding merged 1 commit into
mainfrom
feature/safetycheck-20-checks

Conversation

@fidgetcoding
Copy link
Copy Markdown
Owner

@fidgetcoding fidgetcoding commented Apr 5, 2026

Summary

  • Expands /safetycheck skill from 8 to 20 security checks
  • Adds 12 MCP-specific checks (9-20) that auto-activate when an MCP project is detected
  • Updates existing checks 1, 3, 5, 6, 8 with MCP subsections
  • Updates install script self-test to verify all 20 checks
  • Updates README Step 9 section with MCP security details

New MCP Checks (9-20)

# Check What it catches
9 Tool Description Integrity Prompt injection markers, file paths in descriptions
10 Unicode Smuggling Invisible characters (U+E0000-U+E007F) hiding instructions
11 Encoded Payloads Base64/hex encoded instructions in tool metadata
12 MCP Transport Security DNS rebinding CVEs, HTTP without TLS
13 MCP Authentication Missing auth on HTTP MCP endpoints
14 Token Scope & Lifecycle Over-broad scopes, plaintext tokens
15 Input Schema Validation Missing inputSchema, unvalidated args
16 Tool Response Sanitization Stack traces leaking through tool results
17 CORS / Origin Validation Wildcard CORS on MCP endpoints
18 Supply Chain & Config @latest pins, .mcp.json secrets
19 Audit Logging Missing structured logging for tool invocations
20 Rug-Pull Defense Floating versions, no version pinning

Test plan

  • Run step-9/step-9-install.sh on a clean machine — verify it installs and self-test passes (20/20 checks)
  • Run /safetycheck on a non-MCP project — verify only checks 1-8 run
  • Run /safetycheck on an MCP project — verify all 20 checks run
  • Verify README renders correctly on GitHub

Co-Authored-By: claude-flow ruv@ruv.net

@fidgetcoding @ruvnet
Expand /safetycheck from 8 to 20 checks — add full MCP security suite
f33c177 
Adds 12 new MCP-specific security checks that auto-activate when
an MCP project is detected (package.json with MCP SDK, .mcp.json,
server.tool() patterns, etc).

New checks cover:
- Tool description integrity (prompt injection markers, file paths)
- Unicode/invisible character smuggling (U+E0000-U+E007F range)
- Encoded payloads in tool metadata (Base64, hex)
- MCP transport security (DNS rebinding CVE-2025-66414/66416)
- MCP authentication (missing auth on HTTP endpoints)
- Token scope & lifecycle (over-broad scopes, plaintext tokens)
- Input schema validation (missing inputSchema, unvalidated args)
- Tool response sanitization (stack traces in tool results)
- CORS/Origin validation (wildcard CORS on MCP endpoints)
- Supply chain & config hygiene (@latest pins, .mcp.json secrets)
- Audit logging (structured logging for tool invocations)
- Rug-pull & tool mutation defense (floating versions, no pinning)

Existing checks 1, 3, 5, 6, 8 updated with MCP subsections.
Install script self-test updated to verify 20 checks.
README Step 9 section updated.

Co-Authored-By: claude-flow <ruv@ruv.net>
@fidgetcoding fidgetcoding merged commit a21039a into main Apr 5, 2026
1 check failed
@fidgetcoding fidgetcoding deleted the feature/safetycheck-20-checks branch April 5, 2026 02:30
fidgetcoding added a commit that referenced this pull request Apr 18, 2026
@fidgetcoding
Merge pull request #2 from lorecraft-io/feature/safetycheck-20-checks
a4c2c87 
Expand /safetycheck from 8 to 20 checks — full MCP security suite
fidgetcoding added a commit that referenced this pull request Apr 20, 2026
@fidgetcoding
README: rename Bonus sections to #1/#2 + add manual-install fallback …
3d251e8 
…steps

- Rename 'Bonus - Ghostty Terminal' -> 'Bonus #1 - Ghostty Terminal' (+ anchor updates in Quick Nav + HIW)
- Rename 'Bonus - Arc Browser' -> 'Bonus #2 - Arc Browser' (+ anchor updates)
- Add 'If the script fails — install Ghostty manually' walkthrough: download from ghostty.org, drag to Applications, eject, open
- Add 'If the script fails — install Arc manually' walkthrough: download from arc.net, drag to Applications, eject, sign up, import Chrome
fidgetcoding added a commit that referenced this pull request Apr 20, 2026
@fidgetcoding
README: renumber steps 1-8 + Final, merge bonus Ghostty+Arc into Step 2
13d2eb0 
Step renumbering:
- Step 1 - Claude (was 'Get Claude Running')
- Step 2 - Bonus Software (merges old Bonus #1 Ghostty + Bonus #2 Arc into one step w/ H3 subsections)
- Step 3 - Developer & Utility Tools (was Step 2)
- Step 4 - FidgetFlo + Context Hub (was Step 3)
- Step 5 - Productivity Tools (was Step 6)
- Step 6 - Telegram (was Step 8)
- Step 7 - GitHub (was Step 10 'Developer Tools', renamed + moved up + absorbs /gitfix from Final)
- Step 8 - Safety Check (was Step 9)
- Final Step - Status Line (stripped /gitfix, now Step 7)

Updates:
- Quick Navigation: fully renumbered rows + anchors
- How It Works: fully renumbered bullets + descriptions
- Step 2 body: merged Ghostty + Arc with H3 subsection headers
- Step 7 body: rewrote to cover both GitHub MCP + /gitfix skill
- Final Step body: removed /gitfix references (moved to Step 7)
- Install URLs in Step 2 point to /step-2/ghostty-install.sh and /step-2/arc-install.sh (folders to be renamed next commit)
fidgetcoding added a commit that referenced this pull request Apr 21, 2026
@fidgetcoding
Merge pull request #2 from lorecraft-io/feature/safetycheck-20-checks
ead3336 
Expand /safetycheck from 8 to 20 checks — full MCP security suite
fidgetcoding added a commit that referenced this pull request Apr 21, 2026
@fidgetcoding
README: rename Bonus sections to #1/#2 + add manual-install fallback …
d60837c 
…steps

- Rename 'Bonus - Ghostty Terminal' -> 'Bonus #1 - Ghostty Terminal' (+ anchor updates in Quick Nav + HIW)
- Rename 'Bonus - Arc Browser' -> 'Bonus #2 - Arc Browser' (+ anchor updates)
- Add 'If the script fails — install Ghostty manually' walkthrough: download from ghostty.org, drag to Applications, eject, open
- Add 'If the script fails — install Arc manually' walkthrough: download from arc.net, drag to Applications, eject, sign up, import Chrome
fidgetcoding added a commit that referenced this pull request Apr 21, 2026
@fidgetcoding
README: renumber steps 1-8 + Final, merge bonus Ghostty+Arc into Step 2
7dc4956 
Step renumbering:
- Step 1 - Claude (was 'Get Claude Running')
- Step 2 - Bonus Software (merges old Bonus #1 Ghostty + Bonus #2 Arc into one step w/ H3 subsections)
- Step 3 - Developer & Utility Tools (was Step 2)
- Step 4 - FidgetFlo + Context Hub (was Step 3)
- Step 5 - Productivity Tools (was Step 6)
- Step 6 - Telegram (was Step 8)
- Step 7 - GitHub (was Step 10 'Developer Tools', renamed + moved up + absorbs /gitfix from Final)
- Step 8 - Safety Check (was Step 9)
- Final Step - Status Line (stripped /gitfix, now Step 7)

Updates:
- Quick Navigation: fully renumbered rows + anchors
- How It Works: fully renumbered bullets + descriptions
- Step 2 body: merged Ghostty + Arc with H3 subsection headers
- Step 7 body: rewrote to cover both GitHub MCP + /gitfix skill
- Final Step body: removed /gitfix references (moved to Step 7)
- Install URLs in Step 2 point to /step-2/ghostty-install.sh and /step-2/arc-install.sh (folders to be renamed next commit)
fidgetcoding added a commit that referenced this pull request Apr 25, 2026
@fidgetcoding
README: rename Bonus sections to #1/#2 + add manual-install fallback …
a7c4eac 
…steps

- Rename 'Bonus - Ghostty Terminal' -> 'Bonus #1 - Ghostty Terminal' (+ anchor updates in Quick Nav + HIW)
- Rename 'Bonus - Arc Browser' -> 'Bonus #2 - Arc Browser' (+ anchor updates)
- Add 'If the script fails — install Ghostty manually' walkthrough: download from ghostty.org, drag to Applications, eject, open
- Add 'If the script fails — install Arc manually' walkthrough: download from arc.net, drag to Applications, eject, sign up, import Chrome
fidgetcoding added a commit that referenced this pull request Apr 25, 2026
@fidgetcoding
README: renumber steps 1-8 + Final, merge bonus Ghostty+Arc into Step 2
a7406c3 
Step renumbering:
- Step 1 - Claude (was 'Get Claude Running')
- Step 2 - Bonus Software (merges old Bonus #1 Ghostty + Bonus #2 Arc into one step w/ H3 subsections)
- Step 3 - Developer & Utility Tools (was Step 2)
- Step 4 - FidgetFlo + Context Hub (was Step 3)
- Step 5 - Productivity Tools (was Step 6)
- Step 6 - Telegram (was Step 8)
- Step 7 - GitHub (was Step 10 'Developer Tools', renamed + moved up + absorbs /gitfix from Final)
- Step 8 - Safety Check (was Step 9)
- Final Step - Status Line (stripped /gitfix, now Step 7)

Updates:
- Quick Navigation: fully renumbered rows + anchors
- How It Works: fully renumbered bullets + descriptions
- Step 2 body: merged Ghostty + Arc with H3 subsection headers
- Step 7 body: rewrote to cover both GitHub MCP + /gitfix skill
- Final Step body: removed /gitfix references (moved to Step 7)
- Install URLs in Step 2 point to /step-2/ghostty-install.sh and /step-2/arc-install.sh (folders to be renamed next commit)
fidgetcoding added a commit that referenced this pull request Apr 25, 2026
@fidgetcoding
Merge pull request #2 from lorecraft-io/feature/safetycheck-20-checks
2e5178b 
Expand /safetycheck from 8 to 20 checks — full MCP security suite
fidgetcoding added a commit that referenced this pull request Apr 25, 2026
@fidgetcoding
Merge pull request #2 from lorecraft-io/feature/safetycheck-20-checks
b8030ff 
Expand /safetycheck from 8 to 20 checks — full MCP security suite
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@fidgetcoding