AGENTCFG-03: Coding Agent Auto-Trusts Repository MCP Servers

🟡 Medium · Coding-Agent Configuration

Detects committed settings that trust every MCP server declared in the repository on open (Claude Code enableAllProjectMcpServers: true) or pre-approve every MCP tool (mcp__* allow entries).

Details

Field	Value
Rule ID	AGENTCFG-03
Severity	Medium
Category	Coding-Agent Configuration

Remediation

List the specific MCP servers to enable (enabledMcpjsonServers) and pre-approve individual read-only tools only; let each developer approve new servers.

See Also

• Rule catalog index
• Scanning basics
• SARIF output