MCPVetter

mcpvetter

Audit the MCP servers your AI assistant uses: leaked secrets, unpinned or look-alike packages, risky launch commands, unencrypted remote servers, over-broad file access, poisoned tool descriptions, hidden Unicode, tool shadowing, and silent tool changes.

npx mcpvetter scan          # discover + static scan, offline
npx mcpvetter scan --live   # also read each server's tool descriptions (asks first)

Local, no account, no telemetry. A static scan reads your MCP config files and nothing else. It never changes a config file.

What a finding looks like

■ github
[HIGH] Plain-text secret in MCP config  MCP-SECRET-001 · confidence high · static
    server: github  file: .mcp.json
    Evidence: env GITHUB_PERSONAL_ACCESS_TOKEN=ghp_…[redacted 40 chars] (GitHub token)
    Why it matters: Anything that can read this file, including other tools, backups, sync
    folders, and anyone the file is shared or committed with, gets a working credential.
    Fix: Rotate the credential first (removing it does not un-leak it), then reference it
    from the environment or a secret store instead of the literal value. Claude Code and
    Claude Desktop expand "${VAR}" in .mcp.json, Cursor expands "${env:VAR}", and VS Code
    supports "${input:...}" prompts or an "envFile".

Every finding has a stable ID, separate severity and confidence, redacted evidence, a plain-English reason, and a concrete fix. What each rule checks, and how, is published at mcpvetter.com/rules and in src/scanner/rules.

Clients discovered

Claude Code (~/.claude.json, .mcp.json), Claude Desktop, Cursor (~/.cursor/mcp.json, .cursor/mcp.json), VS Code (mcp.json, settings.json, .vscode/mcp.json), Windsurf, Gemini CLI. Or pass --config <file>.

Commands

mcpvetter scan [--live] [--yes] [--config <file>]... [--json [file]] [--summary] [--fail-on <severity>]
mcpvetter list                               inventory only
mcpvetter explain MCP-POISON-001             explain a finding
mcpvetter rules                              every rule and what it checks
mcpvetter suppress <ID> --server <name> --reason "<why>"
mcpvetter accept <server> --reason "<why>"   accept a server's new tool fingerprint
mcpvetter serve                              run as a local MCP server (stdio)

Exit codes: 0 no findings at or above --fail-on (default high), 1 findings at or above it, 2 scan could not complete. Use it in CI as-is.

Suppressions are always listed in the report, so a shared report cannot hide them.

About --live

To read tool descriptions, MCPVetter has to start each stdio server, exactly as your AI client does every time it launches. It asks before each one, runs it with a minimal environment plus the env your config declares, and only calls initialize, tools/list, prompts/list, and resources/list. It never calls a tool. The first approved probe records a fingerprint of each server's tools in ~/.mcpvetter/fingerprints.json; later probes report any change (a "rug pull") with a before/after diff.

Inside your AI assistant

Claude Code:

claude mcp add mcpvetter -- npx -y mcpvetter@0.1.2 serve

Cursor / VS Code / Claude Desktop (mcpServers or servers):

{ "mcpServers": { "mcpvetter": { "command": "npx", "args": ["-y", "mcpvetter@0.1.2", "serve"] } } }

Then ask: "audit my MCP setup".

Free without an account: check_mcp_setup, explain_finding. With an API key (MCPVETTER_API_KEY, free tier available at mcpvetter.com/account): review_code, secure_pattern, start_lab, check_lab, team_posture. Code review runs on your machine; only rule IDs and counts are sent for your history. Plans: mcpvetter.com/pricing.

Privacy

• Static analysis runs on your machine. Without an API key, MCPVetter makes no network requests.
• With an API key, only rule IDs, severities, and counts are sent. Never code, evidence, file paths, or server names.
• Reports redact secret values by default.

License

MIT