cfg_audit_mcp_config

MCP tool from MCP Security Scanner by badchars

Deep audit of an MCP config file — env var exposure, stdio vs SSE transport, argument injection

How to use it

Project documentation lists cfg_audit_mcp_config for the MCP Security Scanner MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install MCP Security Scanner

$npx -y mcp-security-scanner

FULL MCP SECURITY SCANNER LISTING

Other tools in MCP Security Scanner (39)

cfg_auto_discover

Auto-discover all MCP configuration files — Claude Desktop, Cursor, VS Code, Windsurf, custom paths

cfg_check_context_oversharing

Check for context oversharing — configs exposing too many tools or resources to the agent

cfg_check_shadow_servers

Detect shadow MCP servers — unauthorized servers in config that shouldn't be there

cfg_scan_env_files

Scan .env files for secrets, oversharing, and insecure variable patterns

rt_check_ansi_injection

Detect ANSI escape sequences in tool descriptions that can manipulate terminal output or hide content

rt_check_auth

Analyze server authentication and authorization mechanisms

rt_check_callbacks

Detect callback/webhook URL parameters that could enable SSRF — checks for missing URL constraints

rt_check_capabilities

Inspect server capabilities — experimental features, dynamic tool changes (listChanged), logging, sampling

rt_check_cross_origin

Check for cross-origin tool invocation risks between multiple connected MCP servers

rt_check_http_security

Check HTTP response headers — HSTS, CORS, X-Content-Type-Options, Cache-Control, cookie flags

rt_check_instructions

Analyze server instructions from initialization for poisoning, social engineering, excessive length

rt_check_oauth

Test if HTTP/SSE server validates OAuth tokens — sends no token, invalid token, and forged JWT (alg:none)

rt_check_prompt_injection

Fetch prompt content via getPrompt() and scan for injection patterns, template syntax, dangerous arguments

rt_check_protocol_version

Check server name/version from initialization — flags missing info, outdated SDK versions

rt_check_rate_limiting

Send rapid ping() bursts to test rate limiting — flags servers accepting unlimited requests

rt_check_resource_content

Read actual resource content via readResource() and scan for poisoning, ANSI, Unicode stego, oversized content

rt_check_resource_exposure

Check for sensitive resource exposure through MCP resource endpoints

rt_check_scope_creep

Analyze tool schemas for excessive permissions — tools requesting more access than their description implies

rt_check_tls

Inspect TLS certificate — expired, self-signed, weak signature (SHA-1), short key (<2048 bits), plain HTTP

rt_check_tool_mutation

Dual-snapshot comparison with configurable delay — detect tool additions, removals, description changes (rug pull)

rt_check_tool_poisoning

Scan tool descriptions for 15+ poisoning patterns — hidden instructions, prompt injection, data exfiltration triggers

rt_check_tool_shadowing

Detect tools that shadow or override standard tool names to intercept agent actions

rt_check_unicode_steganography

Detect zero-width Unicode characters used to hide instructions in tool descriptions (steganography)

rt_fuzz_tools

Fuzz-test tools with edge-case inputs — path traversal, command injection, SQL injection, type confusion (dry-run by default)

rt_inspect_server

Connect to a running MCP server (stdio/HTTP/SSE) and enumerate all tools, schemas, resources, and prompts

rt_pin_tools

Generate SHA-256 pins for all tool definitions — descriptions, schemas, and metadata

rt_verify_pins

Verify current tool definitions against previously saved pins to detect rug pull modifications

sast_code_execution

Detect code execution vulnerabilities — eval(), Function(), vm.runInNewContext() with user input

sast_command_injection

Detect command injection vulnerabilities — taint tracking from tool inputs to exec/spawn/execFile sinks

sast_hardcoded_secrets

Detect hardcoded secrets — API keys, passwords, tokens, connection strings in source code

sast_info_disclosure

Detect information disclosure — stack traces, debug output, verbose errors exposed to clients

sast_insecure_crypto

Detect insecure cryptographic usage — MD5, SHA1, ECB mode, hardcoded IVs, weak key sizes

sast_missing_logging

Audit logging coverage — detect tool handlers missing audit logging for security events

sast_path_traversal

Detect path traversal vulnerabilities — taint tracking from tool inputs to fs.readFile/writeFile sinks

sast_prototype_pollution

Detect prototype pollution vectors — unsafe object merging, bracket notation with user input

sast_regex_dos

Detect ReDoS-vulnerable regular expressions — catastrophic backtracking patterns

sast_scan_directory

Full SAST scan of a directory — runs all 11 analyzers with AST-based taint tracking via ts-morph

sast_ssrf

Detect SSRF vulnerabilities — taint tracking from tool inputs to fetch/http.request/axios sinks

sast_unsafe_regex

Detect unsafe regex patterns — unescaped user input in RegExp constructors