---
description: Review an MCP server or connector before it touches marketing data and return GO, GO WITH CONDITIONS or NO-GO
argument-hint: [server name or endpoint or package or vendor docs URL]
---

Use the mcp-security-review skill for this task: $ARGUMENTS

Read martech-context/ first if it exists, especially stack.md, decisions.md, data-dictionary.md and earlier records in mcp-reviews/.
If $ARGUMENTS is empty or vague, ask for the use case in one sentence, the data it will touch, who will use it in which AI client and plan, and the server's endpoint or package with its vendor docs link.
Identify the publisher before running anything. Never start a local server outside a container. Stop for approval before each live capture, local server run (containers included), test account, test call, test write and canary; tests run only in a test account, a person signs in and runs the canary prompts, and the system owner makes the final decision.
Capture the tool list read-only, compare it with the list in the team's client, run the skill's two scripts on the captures and on every client config and settings file, and follow the procedure and acceptance checks in order.
Never ask for, print or store tokens or API keys. Report key names only, and do not open config files with a file-read tool.
Hand back the review record: decision, blockers with evidence, conditions with owners, due labels and closing evidence, evidence per check, the tool list and instructions fingerprints and the re-review triggers. Propose martech-context updates without writing them.

If the mcp-security-review skill is not installed, install it with: npx skills add https://www.martechdevs.com --skill mcp-security-review -a claude-code