Rules / CFG124

CFG124 MCP server launches a full coding agent

Severity: warn OWASP: LLM03:2026 – Excessive Agency OWASP MCP: MCP02:2025 – Privilege Escalation via Scope Creep — provisional (MCP Top 10 v0.1) Agents: claude-code, cline, codex, continue, copilot, cursor, devin, devin-desktop, gemini-cli, goose, grok, junie, kimi-code, opencode, qwen-code, roo-code, vscode, zed

What cfgaudit checks

CFG124 reports a stdio MCP entry that starts a general coding agent in its server mode:

• current codex app-server and legacy codex mcp-server;
• claude mcp serve.

Global CLI options may appear before the server mode. The same forms are recognized through the published npx packages @openai/codex and @anthropic-ai/claude-code. An unrelated executable whose arguments merely contain those words does not match.

This is separate from CFG023 so users can suppress a deliberately deployed agent server without suppressing dangerous permission grants. The agent server exposes a broad agent capability and its own approval model where a purpose-built MCP server would expose a narrow tool.

Trigger example

{
  "mcpServers": {
    "agent": {
      "command": "npx",
      "args": ["-y", "@openai/codex", "app-server"]
    }
  }
}

Safe alternative

Use an MCP server that implements only the required operation, pin its package version, and expose the smallest necessary filesystem and network scope.

References

• Issue #1420: verified current and legacy agent server modes
• CFG023: open-ended agent CLI permission grants
• CFG125: agent CLI bypass options in command sites

Documentation for cfgaudit 1.21.0. Source of this page · Rule implementation