Rules / CFG003

CFG003 enableAllProjectMcpServers: true

Severity: error
OWASP: LLM03:2026 – Excessive Agency
OWASP MCP: MCP02:2025 – Privilege Escalation via Scope Creep — provisional (MCP Top 10 v0.1) CVE: CVE-2025-59536 (CVSS 8.7)

What cfgaudit checks

cfgaudit flags enableAllProjectMcpServers: true in any settings.json. This setting auto-approves every MCP server defined in any .mcp.json discovered in the repository — including ones added by anyone with commit access. A malicious .mcp.json committed to a shared repository executes automatically when another developer opens the project, without any confirmation prompt.

CVE-2025-59536 was exploited via exactly this vector.

Trigger example

{
  "enableAllProjectMcpServers": true
}

Safe alternative

Use an explicit allowlist of trusted server names instead:

{
  "enabledMcpjsonServers": ["github", "memory"]
}

References

• CVE-2025-59536
• Check Point Research: RCE and API Token Exfiltration Through Claude Code Project Files
• Claude Code docs: MCP
• CFG020: unpinned MCP server version
• CFG021: alwaysAllow too broad

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation