Mcp Config Scan

MCP Scan - Scanner for MCP Configurations

🔒 Experimental security scanner for Model Context Protocol (MCP) configuration files

> ## ⚠️ IMPORTANT: EXPERIMENTAL SOFTWARE ⚠️ > > THIS IS EDUCATIONAL SOFTWARE FOR DEMONSTRATION PURPOSES ONLY > > - Not for production security decisions > - May produce false positives or miss real vulnerabilities > - For learning about MCP security concepts only > - Always verify findings manually > - Not a replacement for professional security auditing

---

Features

• Detects exposed API keys, secrets, and cloud credentials
• Finds dangerous filesystem and command injection risks
• Checks for insecure configuration settings
• Colorful console output & structured JSON reports
• Sensitive data masking, report encryption, secure deletion

---

📊 SwampUp 2025 Talk

Slides and demo materials: ➡️ [SwampUp 2025 Slides & Demo](swampup/README.md)

---

Installation

Option 1: Download Pre-built Binary

# Linux/macOS
curl -L https://github.com/AndreaGriffiths11/mcp-config-scan/releases/latest/download/mcp-scan -o mcp-scan
chmod +x mcp-scan

# Windows
curl -L https://github.com/AndreaGriffiths11/mcp-config-scan/releases/latest/download/mcp-scan.exe -o mcp-scan.exe

Option 2: Build from Source

git clone https://github.com/AndreaGriffiths11/mcp-config-scan.git
cd mcp-config-scan
go build -o mcp-scan

Option 3: Go Install

go install github.com/AndreaGriffiths11/mcp-config-scan@latest

Usage Examples

./mcp-scan                            # Scan current directory
./mcp-scan -c config/mcp.json         # Scan specific JSON files
./mcp-scan -c config/mcp.yaml         # Scan specific YAML files
./mcp-scan -f json -o report.json     # Generate JSON report
./mcp-scan demo                       # Run demo scan
./mcp-scan -v                         # Verbose output
./mcp-scan -q                         # Compact output format

---

Configuration Discovery

Scans config files in:

• ./mcp.json, ./mcp.yaml, ./mcp.yml
• ./config/mcp.json, ./config/mcp.yaml, ./config/mcp.yml
• ~/.mcp/config.json, ~/.mcp/config.yaml, ~/.mcp/config.yml
• ~/.config/mcp/config.json, ~/.config/mcp/config.yaml, ~/.config/mcp/config.yml

---

Security Checks

• Critical: Exposed API keys (OpenAI, Anthropic, Mistral, Cohere, Hugging Face, GitHub, AWS, etc.), cloud credentials, private keys, DB credentials
• High: Dangerous filesystem access, shell injection, insecure network settings
• Medium: Dangerous commands, debug mode, suspicious paths
• Low: Disabled configs, excessive timeouts

---

Example Output

╔═══════════════════════════════════════════════════════════════╗
║                         MCP SCAN v1.0                         ║
║              Security Scanner for MCP Configurations          ║
║                     SwampUP 2025 Edition                      ║
╚═══════════════════════════════════════════════════════════════╝

✅ demos/secure-config.json - No security issues found
❌ demos/vulnerable-config.json - 12 issues found:
   [CRITICAL] Exposed OpenAI API Key detected
   [HIGH] Dangerous filesystem access in workingDir
   [HIGH] Potential shell injection vector
   [MEDIUM] Debug mode enabled

════════════════════════════════════════════════════════════════
📊 SCAN SUMMARY
   Configurations scanned: 4
   Security issues found: 18 ❌
⚠️  Please review and address the security findings above
════════════════════════════════════════════════════════════════

---

Demo Configurations

Educational examples in the demos/ directory:

• secure-config.json — Best practices
• vulnerable-config.json — Intentionally unsafe
• mixed-config.json — Secure & risky configs
• development-config.json — Common pitfalls

---

Building from Source

go mod download
go build -o mcp-scan

---

Contributing

We welcome contributions! Here's how you can help:

🐛 Report Bugs

• Use GitHub Issues
• Include MCP config samples (redact secrets!)
• Describe expected vs actual behavior

💡 Suggest Features

• New secret patterns to detect
• Additional security checks
• Output format improvements
• Integration ideas

🔧 Code Contributions

1. Fork the repository
2. Create feature branch: git checkout -b feature/amazing-detection
3. Add tests for new security checks
4. Ensure all tests pass: go test ./...
5. Submit pull request with clear description

📋 Development Setup

git clone https://github.com/AndreaGriffiths11/mcp-config-scan.git
cd mcp-config-scan
go mod download
go build -o mcp-scan
./mcp-scan demo  # Test it works with dummy data

See [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines.

---

License

MIT License — see LICENSE file.

---

⚠️ Security Disclaimer

> ## CRITICAL: EDUCATIONAL USE ONLY > > MCP Scan is an experimental educational tool and should NEVER be used for: > - Production security decisions > - Compliance reporting > - Security assessments of live systems > - Any situation where accuracy is critical > > This tool may: > - Generate false positives (flag safe configurations as dangerous) > - Miss real security vulnerabilities (false negatives) > - Misinterpret configuration contexts > - Fail to detect novel attack patterns > > Always: > - Verify all findings manually > - Consult security professionals for production systems > - Use established enterprise security tools for real audits > - Understand this is for learning MCP security concepts only

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: AndreaGriffiths11
• Source: AndreaGriffiths11/mcp-config-scan
• License: MIT

Install and usage instructions live in the source repository linked above.