Securing Claude Code & VS Code Copilot MCP Agent Workflows

Prevent shell command injection (MCP05), indirect tool poisoning (MCP03), and unapproved destructive actions (MCP07) in terminal-native coding agents.

1. Threat Model for Terminal Coding Agents

Terminal-native agents such as Claude Code and VS Code Copilot Agent Mode combine local shell execution with external MCP servers (GitHub, Linear, Jira, Postgres, Sentry). Untrusted issue descriptions or pull-request comments fetched via one MCP server can trigger indirect prompt injection across other connected servers.

2. Preventing Shell Wrapper Injection (MCP05)

Avoid configuring MCP servers with bash -c or sh -c pipelines. Always invoke the binary directly with an array of discrete arguments so untrusted context cannot break out of shell quoting.

3. Enforcing Human-in-the-Loop Gates (MCP07)

{
  "mcpServers": {
    "github-enterprise": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-github@2025.4.1"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "${env:GITHUB_PERSONAL_ACCESS_TOKEN}"
      },
      "humanInTheLoop": {
        "requireApprovalFor": ["write", "delete", "merge_pull_request", "push_files"],
        "confirmationTimeoutSeconds": 60
      }
    }
  }
}