Audit your MCP servers.
Fix insecure AI-generated code.

A free local scanner for poisoned or risky MCP servers, plus a secure-coding coach inside Cursor and Claude Code: review code, get the secure pattern, and learn the fix with a 5-minute lab.

npx mcpvetter scan

No account. No telemetry. Runs on your machine. Read the source before you run it.

Install See a full sample report

What a finding looks like

Output from the real engine on a typical Cursor config. Every finding has evidence (secrets redacted), why it matters, and the fix.

highRemote MCP server over unencrypted HTTP MCP-TRANSPORT-001

Confidence
high · static evidence
Where
server notes, ~/.cursor/mcp.json
Evidence
url http://notes.example.net/mcp
Why it matters
Over plain HTTP, anyone on the network path (coffee-shop Wi-Fi, a proxy, a compromised router) can read every prompt, tool result, and token, and can inject their own tool descriptions into what the model sees.
Fix
Use the server's https:// endpoint. If it has none, do not send it anything sensitive, or run it locally over stdio instead.

mediumFile access granted to your whole disk or home directory MCP-FS-001

Confidence
high · static evidence
Where
server filesystem, ~/.cursor/mcp.json
Evidence
filesystem allowed path: /
Why it matters
A filesystem server rooted at / or your home directory lets the model read SSH keys, cloud credentials, browser data, and every other project. One prompt injection from a web page or issue is enough to ask for them.
Fix
Grant only the project directories the assistant needs (for example the current repo), never / or ~.

Full sample report · Exactly what each rule checks

One suite: find it, then fix it

MCP Security Scanner Free

Discovers MCP configs for Claude Code, Claude Desktop, Cursor, VS Code, Windsurf and Gemini CLI. Flags leaked secrets, unpinned packages, shell launchers, plain-HTTP remotes, and, with your OK, poisoned tool descriptions and silent changes.

Secure-Code MCP Pro

Lives in your AI client. The model calls review_code before it shows you code that touches auth, data, files or URLs, then secure_pattern and a 5-minute lab when the same flaw shows up twice. It checks at the moment of generation.

Privacy, as implemented

Local first

In local mode your code never leaves your machine. With an API key, only rule IDs, severities and counts are sent.

Remote: in memory only

The remote endpoint analyses submitted code to answer the request and does not store it.

No training

Customer code is never used to train models. Privacy rules

Pricing

Scanner free forever. Pro $39 per developer per month. Team $149 per month for up to 10 developers. Both start with a 7-day trial. Compare plans