Free Tool

MCP Config Check

Paste the MCP config your agent runs. We check every server in it: is the package real, maintained and pinned, does it have known vulnerabilities, and is anything in the file a secret or a risk. The config never leaves your browser.

From claude_desktop_config.json, .mcp.json, ~/.cursor/mcp.json or .vscode/mcp.json. Comments and trailing commas are fine.

What it checks

  1. Package existsEvery npx, uvx or pipx package is looked up on npm or PyPI. A name that does not exist is a typo or a made-up name, and anyone could register it later.
  2. Deprecated or yankedThe version you run is checked against npm deprecation and PyPI yanked flags, including the 12 archived MCP reference servers.
  3. Pinned versionUnpinned npx and uvx fetch whatever is newest on every start, so nobody reviewed the code that runs today.
  4. Known vulnerabilitiesThe resolved version is checked against the OSV database.
  5. Secrets in the configAPI keys, tokens and passwords written straight into env, args, headers or URLs. Found locally and shown masked.
  6. Remote transportPlain HTTP to a remote host, and the legacy SSE transport that the spec replaced with Streamable HTTP.
  7. Access scopeFilesystem servers pointed at / or a whole home folder, and docker flags like --privileged, host networking or the docker socket.
  8. Shell and TLSServers started through a shell string, curl piped into a shell, and TLS checks switched off.
  9. Auto-approved toolsalwaysAllow and autoApprove lists that let tools which write, send or delete run without asking.

Privacy: the check runs in your browser. Only package names and versions are sent, to the public npm, PyPI and OSV APIs. Secrets are detected on your machine and shown masked; nothing you paste is stored or sent to X1Y1. For remote servers, run the MCP Server Check to see their auth setup.