mcp-audit · config-only preview

Paste your MCP config. See what your agents can touch.

A zero-touch hosted read of any MCP client config — what each server can reach, and what's worth reviewing before you connect. No install. No configured server is launched, no configured endpoint is contacted, nothing is stored.

Sends the paste only to /api/scan on this domain. Reads mcpServers (Claude Desktop / Cursor / Windsurf / Claude Code, plus per-project entries). Key names can be reported; values are omitted.

What this checks

Static, config-only inference: what each server can reach (file, network, shell, destructive, exfiltration surface), plus config-health flags — remote endpoints, package-runner launches, credential-heavy entries, duplicate names.

Risk ≠ malicious

A higher score means a broader surface to review and sandbox, not "dangerous." A filesystem server scoring high is expected. The findings list is the actionable part.

Why config-only is conservative

Without launching a server, only declared config is visible, so scores skew low. The deep checks (prompt-injection in tool text, SSRF, the lethal trifecta, schema drift) need a connected scan. Run the CLI for those.

Prompt-injection sandbox

Want the lesson without pasting anything? Open the synthetic sandbox to compare benign twins, risky lookalikes, toy tool descriptions, and config-only proof boundaries.

Hosted boundary

Your paste leaves the browser over HTTPS to this domain's serverless function. Application code parses it in memory for one request, does not log or store the body, and does not contact configured endpoints. Prefer fully local? The same engine ships as a CLI.