subagent

mcp-security-auditor — Claude Code subagent: setup and overview

Q: How to install mcp-security-auditor in Claude Code?

Run `npx claude-code-templates@latest --agent mcp-dev-team/mcp-security-auditor` or place the agent prompt into `.claude/agents/mcp-security-auditor.md`.

Q: Which built-in tools does this subagent rely on?

It requires access to `Read`, `Write`, `Edit`, and `Bash` to inspect files, edit server configurations, and run test scripts.

Audits Model Context Protocol servers for vulnerabilities, configures OAuth 2.1 flows, and designs RBAC. Useful before deploying MCP tools to production.

Install into Claude Code · claude-code-templates All methods and platforms ↓

npx claude-code-templates@latest --agent mcp-dev-team/mcp-security-auditor

Open on GitHub

What mcp-security-auditor does

This subagent audits MCP server implementations, targeting authorization logic and token handling. It inspects OAuth 2.1 flows with PKCE, verifies Origin headers on Streamable HTTP, and checks session isolation to prevent confused deputy exploits.

The agent uses Read, Write, Edit, and Bash tools. It annotates dangerous actions as destructive or privileged, configures permission hierarchies, and benchmarks controls against frameworks like SOC 2 Type II, HIPAA, or GDPR.

Without direct repository file access and execution rights, the agent cannot inspect JSON-RPC handlers or run penetration tests.

What it helps with

inspect MCP servers for token handling and authentication flaws
design granular role hierarchies with annotations for destructive operations
audit server configurations against SOC 2, HIPAA, and GDPR baselines
test JSON-RPC batching and Streamable HTTP endpoints for edge cases

Example prompts for the agent

Audit our MCP server code in server.ts for authorization vulnerabilities
Design an RBAC scheme that marks destructive operations with explicit approval workflows
Review the OAuth 2.1 implementation and PKCE handling across this project

How to install mcp-security-auditor

1claude-code-templates

npx claude-code-templates@latest --agent mcp-dev-team/mcp-security-auditor

2Manually: put the files in place

.claude/agents/mcp-security-auditor.md

For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

Manually: put the files in place

.codex/agents/mcp-security-auditor.toml

Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

Manually: put the files in place

.cursor/agents/mcp-security-auditor.md

Cursor also reads .claude/agents/

Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean

Questions about mcp-security-auditor

How to install mcp-security-auditor in Claude Code?

Run npx claude-code-templates@latest --agent mcp-dev-team/mcp-security-auditor or place the agent prompt into .claude/agents/mcp-security-auditor.md.

What does mcp-security-auditor do?

It assesses MCP servers for protocol-level security gaps, configures access controls, and flags risky tools. The output includes categorized findings with remediation steps.

Which built-in tools does this subagent rely on?

It requires access to Read, Write, Edit, and Bash to inspect files, edit server configurations, and run test scripts.

Similar subagents

All subagents for Security →

code-reviewer official Anthropic This subagent checks code changes for bugs, security issues, and project-rule violations. Use it when a review should focus on findings that matter. 31,050installs security-auditor official Anthropic This subagent searches code for security flaws and gives engineers concrete fixes. Use it to review a project before hardening or modernization work. 10,718installs test-engineer official Anthropic This subagent captures legacy behavior in tests and compares it with a rewritten implementation. Use it before changing existing modules. 9,715installs code-reviewer VoltAgent Community Reviews code changes for bugs, security flaws and maintenance issues. Use it before merging complex work or auditing a project. 31,050installs security-auditor VoltAgent Community Audits security controls, vulnerabilities, risks, and compliance gaps across systems, infrastructure, and processes. Use it when you need documented findings. 10,718installs devops-engineer VoltAgent Community This subagent reviews infrastructure and helps with CI/CD, containers, and deployment workflows. Use it when you want to automate software delivery or add security checks to the process. 7,392installs

From the same set495

The whole set →

figma This skill wires Claude to the Figma MCP server: it pulls node context, a screenshot and assets, then turns the frame into code that matches your project. 858installs create-plan Turns a prompt into one actionable plan with a checklist. Useful when you want the steps agreed before any code changes. 852installs search A skill that runs Google queries through the Bright Data SERP API and hands your agent structured JSON with links, titles and descriptions. 851installs market-research-analyst A Claude subagent that gathers market and competitor data through web search and returns it as a structured research report. 851installs accessibility-auditor Audits web interfaces for accessibility issues and suggests fixes for WCAG, ARIA, keyboard access, and screen-reader use. 846installs content-curator This subagent audits Obsidian notes, spots duplicates and stale material, and suggests cleanup work. Use it when a vault needs regular content review. 846installs test-runner Runs project test suites, isolates failure causes, and suggests fixes. The agent never modifies code directly, returning a diagnostic report instead. 846installs create-onboarding-guide Scans your project repository to generate tailored onboarding documentation for new team members. It extracts stack details and workflows directly from config files. 835installs