domains / families / agent-tooling / mcp-dependency-drift-audit

mcp-dependency-drift-audit

authentic

Statically audit MCP configs for mutable npm/npx package references before approval or CI, without executing discovered MCP servers.

When to use

Before approving `.mcp.json`, Cursor, VS Code, GitHub Copilot, Claude, or Windsurf MCP configuration.
When adding an MCP configuration gate to pull requests or CI.
During an AI-agent security review where npm/npx-backed MCP servers are configured.
When checking whether a previously reviewed MCP config can silently resolve to newer package code.

When not to use

This workflow only covers dependency mutability/review drift for package-backed MCP configuration.
It does not assess prompt injection, tool poisoning, OAuth/authorization, server implementation flaws, malware, provenance, or runtime sandboxing.
Local executables and non-npm launch paths require separate review.
A static config can be reproducible and still unsafe for other reasons.

Source

Repository	Path
sickn33/agentic-awesome-skills	`plugins/agentic-awesome-skills-claude/skills/mcp-dependency-drift-audit/SKILL.md`