# Mcp Config Scan

> Experimental configuration scanner for Model Context Protocol (MCP) configs. For demos, training, and learning secure MCP practices.

- **Type:** MCP server
- **Install:** `agentstack add mcp-andreagriffiths11-mcp-config-scan`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [AndreaGriffiths11](https://agentstack.voostack.com/s/andreagriffiths11)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [AndreaGriffiths11](https://github.com/AndreaGriffiths11)
- **Source:** https://github.com/AndreaGriffiths11/mcp-config-scan

## Install

```sh
agentstack add mcp-andreagriffiths11-mcp-config-scan
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# MCP Scan - Scanner for MCP Configurations

🔒 **Experimental security scanner for Model Context Protocol (MCP) configuration files**

> ## ⚠️ **IMPORTANT: EXPERIMENTAL SOFTWARE** ⚠️
> 
> **THIS IS EDUCATIONAL SOFTWARE FOR DEMONSTRATION PURPOSES ONLY**
> 
> - **Not for production security decisions**
> - **May produce false positives or miss real vulnerabilities** 
> - **For learning about MCP security concepts only**
> - **Always verify findings manually**
> - **Not a replacement for professional security auditing**

---

## Features

- Detects exposed API keys, secrets, and cloud credentials
- Finds dangerous filesystem and command injection risks
- Checks for insecure configuration settings
- Colorful console output & structured JSON reports
- Sensitive data masking, report encryption, secure deletion

---

## 📊 SwampUp 2025 Talk  
**Slides and demo materials:**  
➡️ [SwampUp 2025 Slides & Demo](swampup/README.md)

---

## Installation

### Option 1: Download Pre-built Binary
```bash
# Linux/macOS
curl -L https://github.com/AndreaGriffiths11/mcp-config-scan/releases/latest/download/mcp-scan -o mcp-scan
chmod +x mcp-scan

# Windows
curl -L https://github.com/AndreaGriffiths11/mcp-config-scan/releases/latest/download/mcp-scan.exe -o mcp-scan.exe
```

### Option 2: Build from Source
```bash
git clone https://github.com/AndreaGriffiths11/mcp-config-scan.git
cd mcp-config-scan
go build -o mcp-scan
```

### Option 3: Go Install
```bash
go install github.com/AndreaGriffiths11/mcp-config-scan@latest
```

### Usage Examples

```bash
./mcp-scan                            # Scan current directory
./mcp-scan -c config/mcp.json         # Scan specific JSON files
./mcp-scan -c config/mcp.yaml         # Scan specific YAML files
./mcp-scan -f json -o report.json     # Generate JSON report
./mcp-scan demo                       # Run demo scan
./mcp-scan -v                         # Verbose output
./mcp-scan -q                         # Compact output format
```

---

## Configuration Discovery

Scans config files in:
- `./mcp.json`, `./mcp.yaml`, `./mcp.yml`
- `./config/mcp.json`, `./config/mcp.yaml`, `./config/mcp.yml`
- `~/.mcp/config.json`, `~/.mcp/config.yaml`, `~/.mcp/config.yml`
- `~/.config/mcp/config.json`, `~/.config/mcp/config.yaml`, `~/.config/mcp/config.yml`

---

## Security Checks

- **Critical:** Exposed API keys (OpenAI, Anthropic, Mistral, Cohere, Hugging Face, GitHub, AWS, etc.), cloud credentials, private keys, DB credentials
- **High:** Dangerous filesystem access, shell injection, insecure network settings
- **Medium:** Dangerous commands, debug mode, suspicious paths
- **Low:** Disabled configs, excessive timeouts

---

## Example Output

```
╔═══════════════════════════════════════════════════════════════╗
║                         MCP SCAN v1.0                         ║
║              Security Scanner for MCP Configurations          ║
║                     SwampUP 2025 Edition                      ║
╚═══════════════════════════════════════════════════════════════╝

✅ demos/secure-config.json - No security issues found
❌ demos/vulnerable-config.json - 12 issues found:
   [CRITICAL] Exposed OpenAI API Key detected
   [HIGH] Dangerous filesystem access in workingDir
   [HIGH] Potential shell injection vector
   [MEDIUM] Debug mode enabled

════════════════════════════════════════════════════════════════
📊 SCAN SUMMARY
   Configurations scanned: 4
   Security issues found: 18 ❌
⚠️  Please review and address the security findings above
════════════════════════════════════════════════════════════════
```

---

## Demo Configurations

Educational examples in the `demos/` directory:
- **secure-config.json** — Best practices
- **vulnerable-config.json** — Intentionally unsafe
- **mixed-config.json** — Secure & risky configs
- **development-config.json** — Common pitfalls

---

## Building from Source

```bash
go mod download
go build -o mcp-scan
```

---

## Contributing

We welcome contributions! Here's how you can help:

### 🐛 **Report Bugs**
- Use [GitHub Issues](https://github.com/AndreaGriffiths11/mcp-config-scan/issues)
- Include MCP config samples (redact secrets!)
- Describe expected vs actual behavior

### 💡 **Suggest Features**
- New secret patterns to detect
- Additional security checks
- Output format improvements
- Integration ideas

### 🔧 **Code Contributions**
1. **Fork** the repository
2. **Create** feature branch: `git checkout -b feature/amazing-detection`
3. **Add** tests for new security checks
4. **Ensure** all tests pass: `go test ./...`
5. **Submit** pull request with clear description

### 📋 **Development Setup**
```bash
git clone https://github.com/AndreaGriffiths11/mcp-config-scan.git
cd mcp-config-scan
go mod download
go build -o mcp-scan
./mcp-scan demo  # Test it works with dummy data
```

See [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines.

---

## License

MIT License — see LICENSE file.

---

## ⚠️ Security Disclaimer

> ## **CRITICAL: EDUCATIONAL USE ONLY**
> 
> **MCP Scan is an experimental educational tool and should NEVER be used for:**
> - Production security decisions
> - Compliance reporting  
> - Security assessments of live systems
> - Any situation where accuracy is critical
> 
> **This tool may:**
> - Generate false positives (flag safe configurations as dangerous)
> - Miss real security vulnerabilities (false negatives)
> - Misinterpret configuration contexts
> - Fail to detect novel attack patterns
> 
> **Always:**
> - Verify all findings manually
> - Consult security professionals for production systems
> - Use established enterprise security tools for real audits
> - Understand this is for learning MCP security concepts only

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [AndreaGriffiths11](https://github.com/AndreaGriffiths11)
- **Source:** [AndreaGriffiths11/mcp-config-scan](https://github.com/AndreaGriffiths11/mcp-config-scan)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-andreagriffiths11-mcp-config-scan
- Seller: https://agentstack.voostack.com/s/andreagriffiths11
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.