Audit MCP permissions and catch tool-definition drift

An agent is only as safe as the tools it can call. This tutorial uses the MCP security review template: a desktop agent with filesystem, GitHub, Postgres, a shell server and a remote docs server.

1. The permission graph

Select Claude Desktop configuration. The Agent configuration check runs the Agent Permission Graph on the pasted configuration (Claude Desktop, Claude Code, Cursor, Windsurf, Cline, VS Code mcp.json and Zed are recognised).

The result shows 5 servers reachable by the agent, 3 high-risk; 4 high and 4 medium findings. The graph reads from left to right: the agent, its servers and client roots, then what each server can reach — commands it runs, folders, network endpoints and secrets (by name only). The high findings explain why:

• the filesystem server can read the whole home folder /Users/alex;
• the Postgres container gets an API key on the command line, visible in the process list;
• the shell server runs bash -c and its run_command tool is auto-approved.

2. Secrets stay out

The option Redact secret values in the browser before running and saving is on by default. Before anything is sent, Agentlab replaces values of keys such as API_KEY or TOKEN, known token formats (sk-…, ghp_…, JWTs) and passwords in URLs. References like ${env:GITHUB_TOKEN} stay untouched. The permission graph still sees that a secret is stored in plain text and reports it; Agentlab adds a finding when it had to remove a token-like value.

3. Inspect a server

Select Issue-tracker MCP server. Its Source is Paste tools/list JSON — the way to check local stdio servers. For remote servers choose Connect to a remote server URL.

The result lists three tools. run_command contains text that looks like tool poisoning: hidden instructions to read ~/.ssh and keep quiet. delete_repository is annotated read-only although its name says otherwise. Both are high findings.

When a configuration contains remote servers, the configuration check offers Add MCP checks for the remote servers, which creates one MCP check per URL.

4. Drift detection

MCP servers can change their tool descriptions after you approved them. Agentlab stores a fingerprint of every tool with each run. Run the MCP check again after a server update: tools that changed, were added or removed become findings (Tool “search_issues” changed its definition since the previous run…), and the default gate MCP tools changed or added since the previous run ≤ 0 fails until you have reviewed them. Set a Review by date under Notes and review date and export the reminders with Export → Review reminders (.ics).

5. Cross-checks

The dashboard section Cross-checks between tools compares results across checks:

• Tool “run_command” is auto-approved in “Claude Desktop configuration” but rated high-risk in “Issue-tracker MCP server”.
• The traces call 3 tools that no tool-definition or MCP check declares: run_tests, edit_file, read_file.
• Declared tools that never appear in the traces are listed too — unused tools widen the attack surface.

Capability and risk ratings are inferred from names and descriptions. Treat them as pointers for a human review, not as proof that a server is safe.