Security risks in MCP servers and agent skills
ATR uses 34 versioned rules organized into four namespaces. Common rules and a guardrail apply to every repository; component-specific rules apply to each detected MCP server, skill, or plugin.
Agent-specific risks
Examples of agent-specific risks addressed by the current rules include:
| Risk | Applies to | What the rule evaluates |
|---|---|---|
| Tool definition integrity | MCP servers | Whether a tool definition can change after approval without integrity controls or renewed approval |
| Tool name spoofing | MCP servers | Whether a tool name collides with or imitates another tool |
| Prompt or metadata injection | MCP servers | Whether tool descriptions contain instructions that could steer a model |
| Origin and host validation | MCP servers | Whether a local server validates requests to reduce DNS rebinding exposure |
| MCP authorization | MCP servers | Whether remote authorization follows the expected OAuth and PKCE protections |
| Skill credential harvesting | Skills and plugins | Whether a skill reads credentials or conversation content and transmits it externally |
| Consent suppression | Skills and plugins | Whether instructions attempt to bypass confirmations or human review |
| Declared versus actual behavior | Skills and plugins | Whether a skill’s behavior exceeds its declared purpose |
| Package provenance and mutation | Skills and plugins | Whether a skill or plugin can be impersonated or modified after approval |
An MCP server is assessed against 26 rules: 14 common, one guardrail, and 11 MCP-specific rules. A skill or plugin is assessed against 23 rules: 14 common, one guardrail, and eight component-specific rules.
Common weaknesses
Common rules address security weaknesses that also matter when a model is in the loop, including command injection, server-side request forgery, static secrets, dependency risk, path traversal, insecure deserialization, CI/CD script injection, denial-of-wallet controls, and unsafe tool output.
Framework references
ATR rules map to MITRE Common Weakness Enumeration (CWE) identifiers. Agent-specific rules also reference sources such as the OWASP Top 10 for LLM and Generative AI Applications, MITRE ATLAS, and the Model Context Protocol security guidance. General code rules reference OWASP application, API, and CI/CD security material.
These mappings show the sources used in rule design. They do not mean ATR is certified against, compliant with, or exhaustive of any framework. ATR does not claim complete coverage of the OWASP LLM Top 10.
How scoring works explains trust scores, severity, and results.
Source: BlueRock, Component Level Security Analysis for MCP Servers, Agent Skills and Plugins (Oct. 22nd, 2026).