pentesting-mcp-servers-checklist
A practical, community-driven checklist for pentesting MCP servers. Covers traffic analysis, tool-call behavior, namespace abuse, auth flows, and remote server risks. Maintained by Appsecco and licensed for remixing.
Description supplied by the publisher; it is a claim, not verified evidence.
- Name
- github:appsecco/pentesting-mcp-servers-checklist
- Listed in
- GitHub
- Publisher
- @appsecco
- Published
- 2026-04-07
- License
- CC-BY-4.0
- Evidence
- Listed only, not analyzed yet
Source: https://github.com/appsecco/pentesting-mcp-servers-checklist
What a full analysis of pentesting-mcp-servers-checklist checks
Not checked yet. About 60 tools are analyzed every hour; each check links to its source when it runs:
- Publisher identity: not checked yet
- Repository ownership: not checked yet
- Organization verification: not checked yet
- Artifact provenance: not checked yet
- Source availability: not checked yet
- Version evidence: not checked yet
- Known vulnerabilities: not checked yet
- Install scripts: not checked yet
- Maintenance: not checked yet
- License: not checked yet
Before you install it
- Open the repository and confirm the account is the one you expect: look-alike names are common.
- Read what it asks for: files, accounts, network access and credentials it needs.
- Prefer a version from a verified publisher when one exists.