Plugin developer guide

How to pass a security review for an MCP server

By HOL · Reviewed by Michael Kantor on

Direct answer

Reviewers look for the same few problems: secrets committed in config, launch commands that pull an unpinned package, broad permissions and unclear transport. Run plugin-scanner scan . for security findings, hol-guard plugin check for shipped secret values in MCP config, and add the scanner Action to CI so every pull request is scanned. Fix high-severity findings first, then publish with a pinned version.

Who this is for

MCP server maintainers preparing for a marketplace listing or an enterprise security review.

Good fit

  • Preparing an MCP server for a marketplace or registry listing
  • Answering an enterprise security questionnaire with scan output
  • Blocking pull requests that add a high-severity finding

Not a fit

  • A full penetration test or code audit; scanners find known patterns, not every flaw
  • Certifying a server as safe; no scan can promise that

Steps

  1. 1.Install the scanner and HOL Guard

    The scanner and the Plugin Kit are separate packages from the same open-source repository.

    pipx install plugin-scanner
pipx install hol-guard

  2. 2.Scan for security findings

    The scan covers manifests, secrets, MCP transport and command configuration, approval defaults, skills, dependency lockfiles and GitHub Actions permissions. Fail the run on high-severity findings and fix those first.

    plugin-scanner scan . --fail-on-severity high

  3. 3.Remove shipped secret values

    The Kit warns when an MCP config ships a literal value for a variable whose name looks secret, such as an API key. Replace the value with a reference to the user's environment.

    hol-guard plugin check . --strict

  4. 4.Pin the launch command

    Reviewers reject launch commands that fetch whatever version is newest. Publish the version in server.json; the Kit then writes launch commands such as npx -y @acme/[email protected].

  5. 5.Scan every pull request

    The HOL AI Plugin Scanner Action runs the same scan in GitHub Actions. Set format: sarif and upload_sarif: true to send the findings to GitHub code scanning.

    - uses: hashgraph-online/[email protected]
  with:
    plugin_dir: "."
    fail_on_severity: high

  6. 6.Show the result on your listing

    Connect the repository on HOL to verify ownership. The listing shows the trust score, so reviewers can see the result without running the scan themselves.

Limitations

  • Scanners find known patterns. They do not replace a manual review of what the server does with the data it reads.
  • A passing scan or a HOL listing is not a safety guarantee.
  • Pin the Action to a full commit SHA if your policy requires immutable references.

Questions

Which findings matter most to reviewers?

Shipped credentials, unpinned or remote-fetched launch commands, and tools that run shell commands or write files without an approval step. Fix those before anything cosmetic.

Can I get the results as SARIF?

Yes. plugin-scanner scan . --format sarif --output plugin-scanner.sarif writes SARIF, and the Action can upload it to GitHub code scanning.

Does connecting to HOL send my code anywhere?

HOL scans the public repository behind a listing. The local scanner and the Plugin Kit upload nothing.

Sources

Related guides

List it on HOL

Connect the repository to verify ownership and claim the listing. New plugins can be submitted for free.

Connect your MCP server repository