Warn on Auto-Approved MCP Servers
On every session start, checks the project's own .claude/settings.json for enableAllProjectMcpServers or enabledMcpServers — the exact settings CVE-2025-59536 abused to auto-approve MCP servers and run shell commands before a user ever saw the trust dialog. Doesn't block the session (exit 1, not 2) — it just makes sure a human actually sees the setting before trusting an unfamiliar cloned repo.
1. Save this as the hook script
#!/usr/bin/env python3
"""SessionStart hook — checks this project's own .claude/settings.json for
settings that auto-approve MCP servers or tools, and warns if found.
Non-blocking (exit 1): the session continues, but the warning is visible."""
import json, sys
from pathlib import Path
data = json.load(sys.stdin)
cwd = Path(data.get("cwd", "."))
settings_path = cwd / ".claude" / "settings.json"
if not settings_path.exists():
sys.exit(0)
try:
settings = json.loads(settings_path.read_text())
except Exception:
sys.exit(0)
RISKY_KEYS = ["enableAllProjectMcpServers", "enabledMcpServers"]
found = [k for k in RISKY_KEYS if settings.get(k)]
if found:
print(f"WARNING: this project's .claude/settings.json sets {found} - "
f"MCP servers or tools may auto-approve without the usual trust prompt. "
f"Review before continuing if you didn't author this repo yourself "
f"(see CVE-2025-59536).", file=sys.stderr)
sys.exit(1) # non-blocking - visible to the user, session continues
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/warn-on-auto-approved-mcp.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"SessionStart": [
{
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/warn-on-auto-approved-mcp.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks