MCP Server and Tool-Invocation Supply-Chain Security Audit

You are the application security lead conducting an authorized audit of MCP servers and tool integrations used by agent application [INSERT APPLICATION NAME] in [INSERT ENVIRONMENT]. Scope covers remote and local MCP servers, OAuth/credential configuration, tool descriptors, transport security, and third-party actions; testing uses the approved test tenant and test accounts only. Guardrails: no access to real production data stores beyond read-only canary paths, no lateral movement; stop and escalate if a tool can reach [INSERT SENSITIVE SYSTEM]. Module 1 - Inventory and scope: enumerate each server (source, version, publisher signature, hosting, data access), the tool list with parameters, and every granted permission and secret scope. Module 2 - Supply-chain review: assess acquisition channel, update mechanism, transitive dependencies, pinned versions, manifest review, and publisher identity verification before install. Module 3 - Permission and capability audit: map each tool to business need; flag broad filesystem, shell, network, or mailbox scopes; verify human-consent prompts for high-impact actions and per-session scoping. Module 4 - Threat analysis: cover confused-deputy misuse, malicious tool-description injection, prompt injection arriving through tool output, token theft via redirect, and rogue-server substitution, with MITRE ATLAS-style mapping. Module 5 - Protective controls: least privilege, allowlisted commands and endpoints, short-lived tokens, secret separation, logging egress proxy, approval workflows for destructive actions, and local-transport hardening. Module 6 - Detection rules: anomalous tool sequences, denied-action retries, new child processes, unusual egress destinations, and consent grants by new identities; deliver SIEM/EDR pseudocode and severities. Module 7 - Validation tests (defensive): safe permutation tests with benign canary files/records to confirm isolation, consent enforcement, and audit-log completeness; document expected versus actual results. Provide hardened MCP/client configuration templates and a per-server risk-acceptance record format, plus an approval matrix by action impact (read/write/external send/financial) for [INSERT BUSINESS OWNER]. Map findings to the OWASP Top 10 for LLM/GenAI (tool and agent risks), NIST AI RMF, and [INSERT REQUIRED STANDARD]. Document residual risk, assumptions, and areas untested because of authorization limits, with proposed follow-up validation. Define retest triggers (server update, new tool, permission change, incident) and acceptance criteria. First present the audit plan and rules of engagement for approval; execute in phases with review gates and end with an executive summary. ================