SEC548 / MCP-AUTOAPPROVE-WGET

SEC548 flags MCP configuration when autoApprove includes the exact tool token Bash(wget:*).

Why It Matters

wget is a network-capable download tool often used in remote fetch and install flows. Auto-approving it weakens the review boundary around network-capable shell activity in MCP clients.

Trigger Shape

• the file is a detected MCP configuration surface
• autoApprove is a string array
• the array contains the exact item Bash(wget:*)

Clean Cases

• narrower non-network auto-approval entries
• MCP configs without wget auto-approval
• review-gated wget execution instead of blanket auto-approval

Example Trigger

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "autoApprove": ["Bash(wget:*)"]
    }
  }
}

Safer Example

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "autoApprove": ["Read(*)"]
    }
  }
}

How To Fix

Remove wget from autoApprove and keep remote download execution under explicit user review or a much narrower reviewed policy.