MSCC runs four engines. This page catalogs what each detects. Rule counts change between releases; the categories and mappings below are stable.
| Category | OWASP MCP | Other | Example detections |
|---|---|---|---|
| Prompt injection | MCP-03 | LLM01 | ignore-instructions, system markers, jailbreak, role manipulation, hidden Unicode, delimiter injection |
| Tool poisoning | MCP-02 | hidden HTML-comment instructions, encoded-content runs, XSS in descriptions | |
| Excessive permissions | MCP-01 | shell execution, unrestricted filesystem/network, debug mode, unsafe/raw pointers, FFI | |
| Command injection | MCP-04 | CWE-78/89/94/502/611/917 | shell exec, eval/exec, SQLi, deserialization, XXE, JNDI, reflection, LDAP |
| Secret exposure | MCP-01 | CWE-798/321 | API keys, passwords, tokens, private keys, AWS/GitHub/OpenAI keys, DB connection strings |
| OAuth misconfiguration | CWE-295/319/598 | implicit flow, TLS verification disabled, plain-HTTP MCP server | |
| Data exfiltration | outbound data transmission | ||
| Insufficient logging | MCP-06 | logging disabled | |
| Memory poisoning | OWASP ASI06 | planted instructions, external refs in memory | |
| Skill poisoning | OWASP ASI01 | instruction-shaped skill text | |
| Toxic flow | read-secret + egress in one artifact |
60+ compiled regex rules. Language-specific rules carry a file_types scope so
they only run on the relevant extension.
Language coverage — Python, JavaScript/TypeScript (.js .jsx .ts .tsx .mjs .cjs), Go, Rust, Java, C#. Representative rules per language:
| Language | Rules include |
|---|---|
| Python | subprocess/os.system/eval/exec, insecure deserialization (pickle, unsafe yaml.load) |
| JS/TS | eval & Function, child_process, innerHTML/XSS, prototype pollution, dynamic RegExp, fs write/delete |
| Go | exec.Command, unsafe pointer, SQLi via concatenation/Sprintf, InsecureSkipVerify, path traversal |
| Rust | unsafe blocks, Command::new, raw pointers, FFI, transmute, format! SQLi, path traversal |
| Java | Runtime.exec/ProcessBuilder, deserialization, SQLi, XXE, JNDI, reflection, LDAP, path traversal, hardcoded crypto keys |
| C# | Process.Start, BinaryFormatter/unsafe JSON, SQLi, XXE, path traversal, reflection, LDAP, dynamic Regex, hardcoded connection strings |
Cross-language / config / prose rules — secrets (generic, AWS, GitHub, OpenAI-format, DB connection strings, private keys), prompt-injection and tool-poisoning text patterns, excessive-permission and debug-mode config, OAuth implicit flow.
Many capability-detection rules carry a confidence below 1.0 so they contribute proportionally less to the risk score than a confirmed secret.
Skill and memory analysis — see agent-context.md for the
full rule list. Rules: context-toxic-flow, context-secret-access-instruction,
context-instruction-override, context-embedded-secret,
context-external-reference.
Applied to mcpServers blocks in client configs (recursively, for nested
layouts):
| Rule | Severity | Flags |
|---|---|---|
mcp-client-unpinned-package |
medium | npx/uvx/bunx server launched without a pinned version (supply-chain risk) |
mcp-client-plaintext-secret |
high | Inline credential in a server's env block |
mcp-client-plain-http |
high | Remote server configured over http:// |
Server-side tool manifests (tools[] with capability declarations) add
config-shell-exec, config-fs-unrestricted, and config-net-unrestricted.
Packaged rule packs, extensible with your own .yar files:
| Pack | Rules |
|---|---|
core/owasp-mcp/mcp-01-excessive-agency.yar |
shell execution, unrestricted filesystem/network, debug mode |
core/owasp-mcp/mcp-02-tool-poisoning.yar |
hidden HTML instructions, encoded-content runs, XSS, base64 payloads |
core/owasp-mcp/mcp-03-prompt-injection.yar |
ignore-instructions, system markers, role manipulation, jailbreak, hidden Unicode, delimiter injection |
core/secrets/api-keys.yar |
generic/AWS/GitHub/Slack keys, private keys, DB strings, JWT secrets, OpenAI/Anthropic keys |
See writing-rules.md to add your own.
Any finding on a line containing mscc:ignore is suppressed; scope it to one
rule with mscc:ignore[rule-id] (comma-separate multiple rule ids).