SEC395 / MCP-AUTOAPPROVE-TOOLS

SEC395 flags MCP client configuration that enables blanket tool auto-approval through autoApproveTools: true.

Why It Matters

This setting removes the normal review boundary for every tool invocation exposed by the MCP server. In shared committed config, that creates a broad trust grant that is difficult to audit and easy to inherit accidentally.

Trigger Shape

The rule triggers only when all of these are true:

• the file is a detected MCP config surface
• the path is not fixture-like
• an autoApproveTools key is set to the exact boolean true

Clean Cases

These stay clean:

• autoApproveTools: false
• MCP configs without autoApproveTools
• fixture-like examples under test or fixture paths

Example Trigger

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "autoApproveTools": true
    }
  }
}

Safer Example

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "autoApproveTools": false
    }
  }
}

How To Fix

Disable blanket tool auto-approval and require explicit review or narrowly scoped tool allowlists.