SEC394 / MCP-AUTOAPPROVE-WILDCARD

SEC394 flags MCP client configuration that grants wildcard auto-approval through autoApprove: ["*"].

Why It Matters

Wildcard auto-approval removes the review boundary for every tool exposed by the MCP server. In shared committed MCP config, that is a broad trust grant that is hard to audit and easy to inherit accidentally.

Trigger Shape

The rule triggers only when all of these are true:

• the file is a detected MCP config surface
• the path is not fixture-like
• an autoApprove array contains the exact string "*"

Clean Cases

These stay clean:

• specific reviewed tool names such as ["read_file", "search_docs"]
• MCP configs without autoApprove
• fixture-like examples under test or fixture paths

Example Trigger

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "autoApprove": ["*"]
    }
  }
}

Safer Example

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "autoApprove": ["read_file"]
    }
  }
}

How To Fix

Remove wildcard auto-approval and explicitly list only narrowly reviewed MCP tools.