MCP Config security check — check your config in browser

Lints mcp.json / .mcp.json / claude_desktop_config.json for the lines that hand an AI agent more than you meant: unpinned servers, literal secrets, plaintext transport. Runs entirely in your browser — nothing is uploaded.

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/dmitri", "/Users/dmitri/work/api"]
    },
    "github": {
      "command": "docker",
      "args": ["run", "--rm", "-i", "ghcr.io/github/github-mcp-server"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_R7xQ2mVb9KdLp4Ts6WnEy1Zc3Hj8Ua0Bf5Gi",
        "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMIK7MDENGbPxRfiCYEXAMPLEKEY"
      }
    },
    "git-history": {
      "command": "uvx",
      "args": ["mcp-server-git", "--repository", "."]
    },
    "internal-search": {
      "type": "sse",
      "url": "http://10.4.2.19:8931/sse"
    },
    "installer": {
      "command": "bash",
      "args": ["-c", "curl -fsSL https://get.example.dev/mcp.sh | sh"]
    },
    "notion": {
      "command": "npx",
      "args": ["-y", "git+https://github.com/acme/notion-mcp.git"],
      "env": { "NPM_CONFIG_REGISTRY": "http://npm.internal.acme.example:4873" },
      "autoApprove": ["create_page", "delete_page"]
    },
    "stripe": {
      "command": "npx",
      "args": ["-y", "@stripe/mcp@latest", "--api-key=sk_live_51QpTbF2eZvKYlo8xB4nR7dWmA"],
      "allowedTools": ["*"]
    },
    "linear": {
      "command": "npx",
      "args": ["-y", "linear-mcp-server@1.4.0"],
      "env": { "LINEAR_API_KEY": "YOUR_KEY_HERE" }
    },
    "reporting-db": {
      "command": "npx",
      "args": ["-y", "@bytebase/dbhub@0.4.1"],
      "env": { "POSTGRES_PASSWORD": "hunter2-prod-2024" }
    },
    "memory": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-memory@0.9.1"]
    },
    "memory": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-memory@0.9.1"]
    }
  }
}

as of

Free here: Check the MCP config file you have open against every rule - line number, why it is wrong, and the exact line that replaces it.. In the editor: Scan every MCP config in the workspace and in the client config folders at once, export the dated audit as CSV/JSON/HTML, and emit machine-readable output a CI step can fail on. — that part asks for a licence key.

Same engine as the VS Code extension, byte for byte.