SEC396 / MCP-TRUST-TOOLS

SEC396 flags MCP client configuration that enables blanket tool trust through trustTools: true.

Why It Matters

This setting removes a core review boundary by treating all tool actions as trusted. In shared committed MCP config, that is a broad trust grant that is difficult to audit and easy to inherit accidentally.

Trigger Shape

The rule triggers only when all of these are true:

• the file is a detected MCP config surface
• the path is not fixture-like
• a trustTools key is set to the exact boolean true

Clean Cases

These stay clean:

• trustTools: false
• MCP configs without trustTools
• fixture-like examples under test or fixture paths

Example Trigger

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "trustTools": true
    }
  }
}

Safer Example

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "trustTools": false
    }
  }
}

How To Fix

Disable blanket tool trust and require explicit review or narrower tool approval settings.