# Eslint Plugin Security Mcp

> ESLint rules to detect prompt-injection vectors in Model Context Protocol server code

- **Type:** MCP server
- **Install:** `agentstack add mcp-klodr-eslint-plugin-security-mcp`
- **Verified:** Pending review
- **Seller:** [klodr](https://agentstack.voostack.com/s/klodr)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [klodr](https://github.com/klodr)
- **Source:** https://github.com/klodr/eslint-plugin-security-mcp

## Install

```sh
agentstack add mcp-klodr-eslint-plugin-security-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# eslint-plugin-security-mcp

[](https://github.com/klodr/eslint-plugin-security-mcp/actions/workflows/ci.yml)
[](https://github.com/klodr/eslint-plugin-security-mcp/actions/workflows/codeql.yml)
[](https://vitest.dev)
[](https://codecov.io/gh/klodr/eslint-plugin-security-mcp)
[](https://scorecard.dev/viewer/?uri=github.com/klodr/eslint-plugin-security-mcp)
[](https://socket.dev/npm/package/eslint-plugin-security-mcp)
[](https://coderabbit.ai)
[](https://www.npmjs.com/package/eslint-plugin-security-mcp)
[](https://www.npmjs.com/package/eslint-plugin-security-mcp)
[](https://nodejs.org)
[](https://github.com/klodr/eslint-plugin-security-mcp/pulls)
[](LICENSE)

ESLint rules to detect prompt-injection vectors hidden in
[Model Context Protocol](https://modelcontextprotocol.io) server code.

## Threat model

Strings that an MCP server exposes to an LLM client (tool descriptions,
parameter docstrings, error messages, resource contents, prompts) are a
prompt-injection surface. An attacker who slips encoded instructions into
that surface — via a malicious dependency, a compromised commit, or a
copy-paste from an untrusted source — can hijack the client LLM at decode
time.

This plugin lints the source code of MCP servers to catch two of the most
common encoding tricks:

- **Base64-encoded text** that decodes to printable ASCII (a hand-rolled
  detector with round-trip validation, plain text scoring, and a keyword
  list for known injection phrases like *"ignore previous instructions"*).
- **Invisible Unicode characters** — zero-width spaces, BOMs, and
  Unicode tag characters (U+E0000–U+E007F) that LLMs read but humans don't.

It is **not** a secret scanner. For secrets (API keys, tokens, SRI hashes
that look like high-entropy blobs), use [gitleaks](https://github.com/gitleaks/gitleaks).
The two tools are complementary: gitleaks catches high-entropy blobs,
this plugin catches low-entropy encoded prose.

## Install

```bash
npm install --save-dev eslint-plugin-security-mcp
```

Requires ESLint 10.3.0+ and Node 22.23.1+.

## Usage (flat config)

```js
// eslint.config.js
import mcpSecurity from 'eslint-plugin-security-mcp';

export default [
  // ... your other config blocks
  {
    plugins: { 'security-mcp': mcpSecurity },
    rules: {
      'security-mcp/no-encoded-prompt-injection': 'error',
    },
  },
];
```

## Rules

### `no-encoded-prompt-injection`

Reports string literals and template-literal segments that contain:

1. **Invisible Unicode characters** — always reported as `error`.
2. **Base64 strings that decode to printable text** — reported as `error`.
   When the decoded text matches a known prompt-injection phrase, the
   message is escalated with a `HIGH RISK` prefix.

Hashes following the SRI convention (`sha256-…`, `sha384-…`, `sha512-…`)
are explicitly excluded.

#### Allowing intentional cases

If you have a legitimate base64 fixture (a test vector, a small embedded
asset), opt out per-line:

```ts
// eslint-disable-next-line security-mcp/no-encoded-prompt-injection
const fixture = 'aGVsbG8gd29ybGQgdGhpcyBpcyBhIGZpeHR1cmU=';
```

For test files in particular, you can also disable the rule at the file
or directory level via your `eslint.config.js`.

#### Limitations

- Only detects strings present as literals at lint time. Runtime
  concatenation (`String.fromCharCode(...)`, template assembly across
  multiple `${}` interpolations) is not detected — that is by design;
  static analysis cannot follow arbitrary runtime construction.
- JSON files are not linted unless you configure `eslint-plugin-jsonc`
  or similar.
- Invisible characters in identifiers are caught only if they appear
  inside string literals.

## How it complements other tooling

| Tool            | Catches                               | Misses                                  |
| --------------- | ------------------------------------- | --------------------------------------- |
| **This plugin** | Base64 prose, invisible Unicode       | High-entropy secrets, runtime injection |
| **gitleaks**    | API keys, tokens, SRI-shaped blobs    | Low-entropy encoded prose               |
| **CodeQL**      | Taint flows, dataflow vulnerabilities | Encoding-layer tricks                   |
| **OSV-Scanner** | Known CVEs in dependencies            | Source-level threats                    |

Recommended layered defense for an MCP repo:

```text
IDE (eslint extension)           → real-time feedback
Pre-commit (husky + lint-staged) → eslint on staged files
CI                               → eslint full scan + gitleaks + OSV-Scanner + ...
```

## Contributing

See [CONTRIBUTING.md](.github/CONTRIBUTING.md). All contributions are
licensed under Apache-2.0 via [DCO](https://developercertificate.org/)
sign-off.

## License

Copyright 2026 klodr

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

```text
http://www.apache.org/licenses/LICENSE-2.0
```

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the [LICENSE](./LICENSE) file for details.

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [klodr](https://github.com/klodr)
- **Source:** [klodr/eslint-plugin-security-mcp](https://github.com/klodr/eslint-plugin-security-mcp)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-klodr-eslint-plugin-security-mcp
- Seller: https://agentstack.voostack.com/s/klodr
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.