MCP Config security check — check your config in browser

Six lines in one shared .mcp.json hand an AI agent more than anybody meant to give it - and if you are the platform engineer who set up Claude Code, Copilot or Cursor for a US or EU team repo, this is what that file says back:

L5   error  unpinned_npx     "filesystem" runs an unpinned npm package - the next publish runs on your machine.
L5   error  broad_fs_root    "filesystem" is given /Users/dmitri - the whole home directory, .ssh and .aws too.
L11  error  secret_literal   A live credential is written into this file (GITHUB_PERSONAL_ACCESS_TOKEN).
L21  error  plaintext_http   "internal-search" is reached over plain http:// - header and all, in clear text.
L31  error  auto_approve     "notion" runs tools without asking (create_page, delete_page) - no confirmation.
L35  error  secret_in_args   "stripe" gets a credential as a command-line argument - every process list sees it.

Six lines, and each one has a replacement that takes a few seconds: [email protected] instead of server-filesystem, ${env:GITHUB_PAT} instead of the token, ./services/api instead of the home directory. Those six are part of 24 findings - 17 errors and 7 warnings - that MCP Config Guard reports on the ten-server sample shipped with the extension. On the clean version of the same file it reports zero.

An MCP config is the least-reviewed file in the repository and the one with the widest blast radius. It tells Claude Code, Copilot, Cursor or Windsurf which servers to start, what to start them with, and which credentials to hand them. A little JSON decides what an agent may run on your machine. It is copied out of a README, it works on the first try, and nobody opens it again.

The line that changes under you. "command": "npx", "args": ["-y", "server-filesystem"] resolves the package again every single time the agent starts. The code you reviewed is not necessarily the code that runs tomorrow: the maintainer's next publish, a compromised account or a typosquat arrives with no action from you.

The line with the credential in it. The env block is the path of least resistance, so live tokens end up there - a GitHub PAT, an AWS secret, a database password - in a file that is committed, cloned, backed up and screen-shared. A key passed in args instead of env is visible to every process list on the machine.

The line that reaches too far. "/Users/dmitri" as a filesystem root is not a project directory. It is .ssh, .aws and every other repository on the disk, and it hard-codes one person's home directory, so it breaks for every teammate who clones the repo.

MCP Config Guard reads that file while you edit it and marks each of these lines. It covers 23 rules in four groups - how the code gets there, what it is handed, how far it reaches, how it is reached - and every finding gives the line number, one sentence on what goes wrong, and the line that replaces it.

Two things it deliberately does not do. It does not upload the file, and it does not connect to any server in it. A scanner that reads tool descriptions has to start the server first - that executes the code you are trying to judge. This one reads text, offline. That is also why pasting the config into a chatbot is not the free alternative it looks like: the credentials go with it.

Checking the file you have open is free, with all 23 rules, no key, no watermark and no limit. That is a finished job. The paid layer is a different axis: one sweep over every MCP config in the workspace and in the client config folders, a dated CSV, JSON or HTML report, and machine-readable output a CI step can fail on, so the pull request that adds an unpinned server stops before it merges. Upwork lists cybersecurity developers at a $60 median hourly rate; the sweep is the part somebody would otherwise repeat by hand every time a server is added. The extension is $29 once, one licence key per person or CI seat.