MCP Config Security Linter
Scan your claude_desktop_config.json, mcp.json, or config.toml for leaked credentials, unsafe sandbox paths, and unpinned packages with 1-click remediation.
Automatically convert plaintext credentials into environment references and constrain root paths.
Exposed plaintext credential string matching GitHub Personal Access Token found directly in configuration.
Replace with environment variable expansion (e.g. '${GITHUB_TOKEN}') and inject via your host environment or .env file.
Exposed plaintext credential string matching Database URL with Password found directly in configuration.
Replace with environment variable expansion (e.g. '${GITHUB_TOKEN}') and inject via your host environment or .env file.
Exposed plaintext credential string matching Hardcoded API Key / Secret Token found directly in configuration.
Replace with environment variable expansion (e.g. '${GITHUB_TOKEN}') and inject via your host environment or .env file.
Server 'github' executes '@modelcontextprotocol/server-github' without a locked version tag (e.g. '@0.6.2').
Pin package versions to prevent breaking changes or supply-chain poisoning (e.g. '@modelcontextprotocol/server-filesystem@0.6.2').
Server 'filesystem' executes '@modelcontextprotocol/server-filesystem' without a locked version tag (e.g. '@0.6.2').
Pin package versions to prevent breaking changes or supply-chain poisoning (e.g. '@modelcontextprotocol/server-filesystem@0.6.2').
Filesystem server 'filesystem' exposes an overly permissive directory 'C:/'. An agent could read or overwrite system-critical files.
Scope the sandbox to a specific dedicated project folder (e.g. 'C:/Users/name/Projects/sandbox' or './workspace').
Filesystem server 'filesystem' exposes an overly permissive directory '~/.ssh'. An agent could read or overwrite system-critical files.
Scope the sandbox to a specific dedicated project folder (e.g. 'C:/Users/name/Projects/sandbox' or './workspace').
Server 'postgres' executes '@modelcontextprotocol/server-postgres' without a locked version tag (e.g. '@0.6.2').
Pin package versions to prevent breaking changes or supply-chain poisoning (e.g. '@modelcontextprotocol/server-filesystem@0.6.2').
Remote database connection for 'postgres' does not enforce SSL/TLS encryption.
Append '?sslmode=require' to your PostgreSQL URL or enable SSL mode in database parameters.
All audits execute 100% locally in your browser. Configurations and secrets never touch external servers or APIs.
The 5 Critical MCP Configuration Vulnerabilities
Autonomous AI agents possess unprecedented agency to inspect repositories, issue database queries, and manipulate filesystems. A single misconfigured MCP server can transform a helpful coding assistant into an accidental security liability.
1.Plaintext Token Leakage
Hardcoding GitHub PATs, Slack bot tokens, or AWS credentials directly inside client JSON files frequently results in credentials being committed to public Git repos or captured in desktop screenshot telemetry. Always use environment variable expansion (${TOKEN}).
2.Unsandboxed Root Filesystems
Passing /, C:\, or ~ to filesystem servers grants AI models read/write access to your SSH keys (~/.ssh), AWS credentials (~/.aws), and shell profiles. Always restrict paths to explicit project subdirectories.
3.Database Superuser Connections
Connecting PostgreSQL, MySQL, or MongoDB servers with administrative credentials allows agents to execute destructive DROP, TRUNCATE, or ALTER statements. Always provision dedicated read-only roles with tight statement_timeout limits.
4.STDOUT Protocol Corruption
In stdio transport, standard output is strictly reserved for JSON-RPC 2.0 framing. Custom scripts that write console.log() or print debug strings to STDOUT will immediately crash the client parser with error -32603.