MCP Permission Auditor

Local MCP config audit

Scan MCP configs for exposed secrets and unsafe commands

An MCP configuration security audit checks server commands, environment variables, package versions, remote URLs and file-access scope before an MCP client starts them. Paste your JSON below to find hardcoded secrets, shell execution, unpinned packages and excessive permissions. The scan runs entirely in your browser, and you can download a redacted Markdown report with fixes.

Scan my MCP config

Free · no account or email · configuration stays on this device

Claude Desktop JSON Cursor MCP JSON VS Code server JSON JSONC comments
MCP configuration security findings and remediation report

Free browser tool

MCP configuration security scanner

Paste an MCP JSON configuration or open a local file. The auditor checks each server definition, ranks actionable findings by severity and creates a redacted report you can use during remediation or code review.

Local configuration audit

NO NETWORK REQUEST
MCP configuration JSON / JSONC

The file is read by your browser only. This page does not upload, store or transmit the configuration.

Your MCP audit results appear here Run the included example or replace it with your own configuration. No data leaves this page.
Transparent methodology: the score begins at 100 and subtracts 25 points per Critical finding, 15 per High, 8 per Medium and 3 per Low. Duplicate findings for the same path are consolidated. A high score is not a safety guarantee; review package provenance, server source code and runtime behavior separately. Methodology updated .

What the audit checks

Find risky MCP server settings before they execute

The scanner focuses on configuration evidence you can act on immediately. Findings include the affected JSON path, why it matters and a concrete remediation step.

Exposed secrets and insecure endpoints

Detect literal tokens, passwords and API keys in environment blocks, plus unencrypted HTTP server URLs.

  • Credential-like environment keys
  • Bearer and common token patterns
  • Plain HTTP remote transports

Unsafe MCP shell commands

Surface shell interpreters, command-string execution and download-to-shell pipelines that hide the actual program being run.

  • bash, sh, zsh, PowerShell and cmd
  • curl or wget piped to a shell
  • Public network bindings and root mounts

Excessive permissions and supply-chain drift

Flag wildcard approvals, broad filesystem roots and package references that can change between installations.

  • Wildcard tool or permission grants
  • Home, drive and filesystem-root access
  • Unpinned npx, uvx and container packages

Copy-ready remediation playbook

Fix common MCP configuration risks

Use these before-and-after patterns as a starting point, then adapt paths, versions and environment-variable syntax to the MCP client and operating system you actually use.

Remove hardcoded API keys from MCP environment settings

A literal credential can leak through source control, screenshots, backups or shared configuration files.

  1. Revoke and rotate any credential already shared.
  2. Move the value to an environment variable or supported secret manager.
  3. Give the replacement key only the permissions the server needs.
Riskyliteral value
{
  "env": {
    "API_KEY":
      "secret-value-here"
  }
}
Safer patternreference
{
  "env": {
    "API_KEY":
      "${MCP_API_KEY}"
  }
}

Replace unsafe shell wrappers and pipe-to-shell installers

A shell command string is harder to review than a direct executable with explicit arguments. Download-to-shell pipelines add remote content to the execution path.

  1. Install and inspect the dependency separately.
  2. Call the reviewed executable directly.
  3. Keep each argument in the configuration’s argument array.
Riskyhidden execution
{
  "command": "bash",
  "args": [
    "-c",
    "curl URL | sh"
  ]
}
Safer patterndirect command
{
  "command":
    "/opt/mcp/bin/server",
  "args": [
    "--read-only"
  ]
}

Pin the MCP package and narrow filesystem access

Unpinned packages can change without a configuration edit. Granting “/”, an entire drive or the whole home directory exposes more data than most tasks require.

  1. Select and review an exact package version.
  2. Restrict access to the smallest project directory.
  3. Use read-only capabilities whenever the server supports them.
Riskyfloating + broad
{
  "command": "npx",
  "args": [
    "package-name",
    "/"
  ]
}
Safer patternpinned + scoped
{
  "command": "npx",
  "args": [
    "package-name@1.2.3",
    "/work/project/docs"
  ]
}

Three-step workflow

How to audit MCP permissions and configuration

Start with the exact configuration used by your MCP client, resolve the highest-impact findings first and rescan the edited file before deployment.

01

Paste or open the active MCP config

Use the configuration your client actually reads. JSON comments and trailing commas are accepted, and the file never leaves the browser.

Recognized roots: mcpServers · servers · command · url
02

Review Critical and High findings

Rotate exposed credentials before changing the file. Then remove hidden shell execution, unencrypted endpoints, root mounts and wildcard grants.

Fix order: secrets → execution → access scope → reproducibility
03

Download the redacted report and rescan

Use the Markdown checklist during review. The export removes credential values and records the scan time, finding path and recommended fix.

Deliverable: mcp-security-audit-YYYY-MM-DD.md

MCP security FAQ

Questions about scanning MCP configuration files

Short answers for developers reviewing local and remote Model Context Protocol server settings.

What is an MCP configuration security audit?

It is a review of the commands, arguments, environment variables, remote URLs and access scope defined for Model Context Protocol servers before an MCP client launches them. This scanner converts those configuration signals into prioritized, explainable findings.

Does this MCP security scanner upload my configuration?

No. Parsing, checks and report generation run inside your browser. Opening a file uses the browser’s local File API, and the downloadable report is created with a local Blob. No account, email address or server upload is required.

Which MCP configuration formats can I scan?

The scanner accepts JSON and JSONC-style files with comments or trailing commas. It recognizes common mcpServers and servers objects, plus a single server object containing command or url. YAML and TOML should be converted to JSON before scanning.

What MCP security risks does the scanner detect?

Checks cover hardcoded secrets, shell interpreters, download-to-shell pipelines, unpinned npx or uvx packages, floating or latest container tags, broad filesystem roots, insecure HTTP endpoints, wildcard permissions, public host bindings and root container mounts.

How should API keys be stored in an MCP config?

Avoid committing literal credentials. Use an environment-variable reference or secret manager supported by your client and deployment environment. Restrict the credential to the smallest required scope, and rotate it immediately if it may have entered source control, logs or a shared file.

Why should MCP server package versions be pinned?

Pinning makes installation behavior reproducible and stops a future release from being selected solely because a command runs later. Version pinning is only one control: review package ownership, release contents, integrity information and transitive dependencies before executing the package.

Does a high audit score guarantee an MCP server is safe?

No. The score summarizes deterministic configuration checks; it is not source-code analysis, malware detection, sandboxing or runtime monitoring. Review the server’s code and provenance, confirm each capability is necessary, restrict operating-system permissions and observe runtime network and filesystem behavior.

Why does MCP filesystem permission scope matter?

An MCP filesystem server can expose every file under an allowed path to tool operations supported by that server. A project-specific directory limits the impact of mistakes or malicious instructions. Avoid filesystem roots, whole drives and home directories when a smaller read-only location will work.

Use the report today

Download your redacted MCP security checklist

Scan your current configuration or download the included sample audit. The Markdown file contains prioritized findings, affected paths and a practical remediation checklist.

Review remediation examples

Free · no registration · generated locally · sample fallback included