mcp-server-hardening SKILL.md skillB
mcp-server-hardening from fabioc-aloha/alex_skill_mall is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add fabioc-aloha/alex_skill_mall/mcp-server-hardening@git:20260914.0426f9ePins git:20260914.0426f9e in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- fabioc-aloha/alex_skill_mall
- Path
plugins/ai-agents/mcp-toolkit/skills/mcp-server-hardening/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260914.0426f9e, committed Sep 14, 2026
- Size
- 4,634 bytes
- Repository stars
- 5
- License
- MIT
Secure an MCP server that is reachable over a network — host-name validation against DNS rebinding, CORS restraint, authentication, secret handling, and the confused-deputy problem.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Harden an MCP Server A stdio server needs none of this. An HTTP server needs all of it before it is reachable, because an MCP server is an execution surface that an LLM drives. ## Validate Host Names ASP.NET Core's Kestrel does not check the `Host` header by default, and it is not alone. Without validation, a browser can be steered to your local server through an attacker-controlled DNS name while sending that name in the header — DNS rebinding. - **Locally**: restrict allowed hosts to loopback values. - **In production**: configure the exact public host names, and validate at the proxy or load balancer when one forwards requests. This also stops untrusted host names being reflected through features that generate absolute URLs. ## Do Not Enable CORS By Default Turn on cross-origin requests only if you intend browser-based cross-origin access. When you do, use the most restrictive policy that works. CORS is not a substitute for host-name validation. They defend different things: CORS governs which browser origins may call you, host validation governs which names you will answer to. ## Authenticate …
Read the whole file at its exact version.
How to install
mdr add fabioc-aloha/alex_skill_mall/mcp-server-hardening@sha256:0ecd8abe14e6bec3The line at the top of this page pins the label git:20260914.0426f9e, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_bjtl4qtt3vtwuzfh)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 14, 2026.
Audit of the latest version
- fail: No prompt-injection phrasing (matched: ignore previous instructions)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4634 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
fabioc-aloha/alex_skill_mall · 5 stars · license MIT · pushed 2026-11-06 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_bjtl4qtt3vtwuzfh GET https://markdownregistry.com/api/v1/resolve?ref=fabioc-aloha/alex_skill_mall/mcp-server-hardening GET https://markdownregistry.com/api/v1/blob/0ecd8abe14e6bec3f6e3e85a7a5ec2572371c41828cf908f2129c8f89b6ed09f
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.