Ship an MCP server the internet can't turn into a file-read or RCE machine.
Every tool your LLM calls is driven by untrusted content. One missed ../ or shell=True and your agent leaks /etc/passwd or runs attacker commands. This kit is the exact checklist, copy-paste guards, and attacker payloads that stop it — pulled from real audits of production MCP servers.
One-time. Instant access. Written by a working security researcher.
What's inside
Path confinement The #1 MCP CVE class. A symlink- and absolute-path-proof resolve_within() and the call-site regression that re-opens it.
No-shell command exec Argv-array pattern + how to block argument injection on the args users do influence.
Deserialization (RCE) pickle / torch.load / yaml / numpy — huntr's most-paid class — and the safe replacements.
SSRF in URL fetchers Block cloud-metadata & localhost with a private-IP resolver you can paste in.
Attacker test payloads The exact strings to fire at your own server so you find the hole before they do.
CI pre-deploy checklist Grep one-liners + a box-tick list to run every release.
Free sample — the pre-deploy audit checklist
[ ] grep -rn "shell=True\|os.system\|subprocess.call(" src/
[ ] grep -rn "pickle.load\|yaml.load(\|torch.load(\|allow_pickle=True" src/
[ ] grep -rn "open(\|Path(\|send_file\|extractall" src/ # every path sink
[ ] every path sink flows through resolve_within() and refuses None
[ ] every subprocess is an argv list with a timeout; user args whitelisted
[ ] every URL fetch is scheme+IP validated, no redirects, size-capped
[ ] no secrets in code/output; inputs length+type bounded
[ ] ran the attacker payloads against a LOCAL instance — all refused
The full kit gives you the code that makes every one of these boxes pass — copy-paste, framework-agnostic Python.
Why trust it
Written by a security researcher who audits MCP servers and AI/ML packages for a living. Every guard here maps to a real CVE class (e.g. path-traversal file-read in MCP file tools, CVE-2026-54785). No theory, no AI slop — patterns that shipped.