mcp-prohibited

Repository should not enable non-allowlisted MCP servers

Severity	error (disabled)
Autofix	-
Since	v0.1.0
Category	MCP (Model Context Protocol)

Why

MCP servers run as child processes with access to the local filesystem and network. A project-scoped configuration that enables a non-allowlisted MCP server can execute arbitrary code when a contributor opens the repository — this is a supply-chain attack vector analogous to malicious npm lifecycle scripts.

Examples

Bad (no allowlist configured):

{
  "mcpServers": {
    "unknown-server": {"command": "npx unknown-package"}
  }
}

Good (with allowlist):

# .skillsaw.yml
rules:
  mcp-prohibited:
    allowlist:
      - "filesystem"
      - "github"

How to fix

Review the flagged MCP server. If it is trusted, add its name to the allowlist in your skillsaw config. Allowlist entries match by server name (the key in mcpServers). This rule is disabled by default — enable it for supply-chain-sensitive repositories.

Configuration

rules:
  mcp-prohibited:
    enabled: false  # true | false | auto
    severity: error

Parameter	Description	Default
allowlist	MCP server names that are permitted	[]

Run skillsaw explain mcp-prohibited to see this documentation and the rule's effective configuration in your terminal.