SEC551 / MCP-AUTOAPPROVE-GIT-PUSH

SEC551 flags MCP configuration when autoApprove includes the exact tool token Bash(git push).

Why It Matters

git push is a remote mutation boundary. Auto-approving it removes review from publishing repository state changes to a remote.

Trigger Shape

• the file is a detected MCP configuration surface
• autoApprove is a string array
• the array contains the exact item Bash(git push)

Clean Cases

• review-gated remote git mutation
• narrower read-only git shell permissions
• configs without git push in autoApprove

Example Trigger

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "autoApprove": ["Bash(git push)"]
    }
  }
}

Safer Example

{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "autoApprove": ["Read(*)"]
    }
  }
}

How To Fix

Remove git push from autoApprove and keep remote git mutation under explicit user review.