Rules / CFG053
CFG053 blanket MCP-trust settings beyond enableAllProjectMcpServers
Severity: error (blanket boolean / wildcard) · warn (large list / wildcard allowlist URL)
OWASP: LLM03:2026 – Excessive Agency
OWASP MCP: MCP02:2025 – Privilege Escalation via Scope Creep — provisional (MCP Top 10 v0.1)
What cfgaudit checks
CFG003 flags enableAllProjectMcpServers: true. Claude Code has sibling settings that also auto-trust MCP servers wholesale; a repo- or org-committed settings.json enabling them removes the per-server trust decision (CVE-2025-59536 class):
| Setting | When | Severity |
|---|---|---|
allowAllClaudeAiMcps: true |
loads every Claude.ai MCP server (managed/enterprise) | error |
enabledMcpjsonServers contains "*" |
auto-approves all .mcp.json servers — a repo can add a server that runs with no prompt |
error |
enabledMcpjsonServers has ≥ 10 entries |
auto-approving this many is rarely deliberate (mirrors CFG011) | warn |
allowedMcpServers has a wildcard serverUrl (*, https://*, …) |
the enterprise allowlist matches every host, so it restricts nothing | warn |
allowedMcpServers is an allowlist (restriction) — a specific list is good and not flagged; only an everything-matching wildcard serverUrl defeats it. A scoped pattern like https://*.corp.example/* is fine. Absent keys / false produce no finding.
Trigger example
{
"allowAllClaudeAiMcps": true,
"enabledMcpjsonServers": ["*"]
}
→ two error findings.
Safe alternative
Approve MCP servers individually: list the specific server names in enabledMcpjsonServers, leave allowAllClaudeAiMcps unset, and scope any allowedMcpServers serverUrl to specific hosts.
References
- CFG003 (
enableAllProjectMcpServers) — the original blanket-MCP-trust rule - CFG011 (broad MCP
alwaysAllow), CFG010/CFG017–CFG021/CFG049/CFG050 (per-server MCP rules) - OWASP Top 10 for MCP — MCP02 (Privilege Escalation via Scope Creep)
Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation