lintai docs

Appearance

Rule Reference

SEC552lintai-ai-securitygovernancehardeningstablejsonwarn

MCP config: gh api POST auto-approve

MCP configuration auto-approves `Bash(gh api --method POST:*)` through `autoApprove`

Public lane
governance
Category
hardening
Provider
lintai-ai-security
Scope
per-file
Surface
json
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message only
How to read this lane

Shared authority and workflow policy review.

How to read this category

Least-privilege, provenance, or operational hygiene signal.

Activation Model

Preset Activation

These presets explain where this rule appears in the product experience.

governancesidecar lane
mcpsurface preset

Lifecycle

Stable Lifecycle Contract

State

stable

Graduation rationale

Matches exact GitHub API POST auto-approval in MCP client config.

Deterministic signal basis

JsonSignals exact array-item detection for `autoApprove: ["Bash(gh api --method POST:*)"]` on parsed MCP configuration.

Malicious corpus
mcp-autoapprove-git-push-gh-api-post
Benign corpus
mcp-autoapprove-git-push-gh-api-post-specific-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesgovernancehardeningjson
SEC394MCP config: wildcard auto-approveMCP configuration auto-approves all tools with `autoApprove: ["*"]`governancehardeningjson
SEC395MCP config: autoApproveTools trueMCP configuration auto-approves all tools with `autoApproveTools: true`governancehardeningjson
SEC396MCP config: trustTools trueMCP configuration fully trusts tools with `trustTools: true`governancehardeningjson
SEC397MCP config: sandbox disabledMCP configuration disables sandboxing with `sandbox: false` or `disableSandbox: true`governancehardeningjson
SEC398MCP config: wildcard capabilitiesMCP configuration grants all capabilities with `capabilities: ["*"]` or `capabilities: "*"`governancehardeningjson

SEC552 / MCP-AUTOAPPROVE-GH-API-POST ​

SEC552 flags MCP configuration when autoApprove includes the exact tool token Bash(gh api --method POST:*).

Why It Matters ​

gh api --method POST is a direct GitHub mutation primitive. Auto-approving it removes review from API-side state changes.

Trigger Shape ​

  • the file is a detected MCP configuration surface
  • autoApprove is a string array
  • the array contains the exact item Bash(gh api --method POST:*)

Clean Cases ​

  • read-only GitHub CLI access
  • review-gated GitHub API mutation
  • configs without gh api --method POST in autoApprove

Example Trigger ​

json
{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "autoApprove": ["Bash(gh api --method POST:*)"]
    }
  }
}

Safer Example ​

json
{
  "mcpServers": {
    "demo": {
      "command": "node",
      "args": ["server.js"],
      "autoApprove": ["Read(*)"]
    }
  }
}

How To Fix ​

Remove gh api --method POST from autoApprove and keep GitHub API mutation under explicit user review.