MCP & Claude Code Auditor

Paste an MCP server config (claude_desktop_config.json / Cursor) or a Claude Code settings.json. The auditor auto-detects the shape and checks for dangerous transports, hardcoded secrets, tool poisoning, broad-permission allow rules, hostile hooks, and bypass-permission modes. All checks run locally.

Config JSON

What this checks

MCP config

Dangerous startup commands — bare shells, curl | sh installers, destructive primitives.
Hardcoded credentials — secret-shaped values in env / args.
Tool description injection — prompt-injection patterns inside tool descriptions (tool poisoning).
Broad-permission tool names — exec, run_shell, eval (excessive agency).
Insecure remote transports — plain HTTP, third-party hosts, unrestricted flags.

Claude Code settings

Permission allow/deny rules — flags Bash(*), dangerous primitives in allow, missing deny lists, sensitive Read paths (~/.ssh, /etc).
Permissive default modes — bypassPermissions and acceptEdits flagged as silent-execution risks.
Hostile hooks — curl | sh in hook commands, remote URL hooks, network egress in PreToolUse / UserPromptSubmit, missing timeouts, embedded secrets.
apiKeyHelper — flagged when it executes remote / piped code.
enableAllProjectMcpServers — auto-trusts every .mcp.json in the project tree.

References

Heuristics only. A clean report is not a security guarantee — review upstream code, pin versions, and watch tool descriptions on every update.