Sample report

The static scan output for the config below, rendered by the same engine you run locally. The token is fake and is redacted in the evidence exactly as a real one would be.

Input

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-github"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_****************"
      }
    },
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem@2025.8.21",
        "/"
      ]
    },
    "notes": {
      "url": "http://notes.example.net/mcp"
    }
  }
}

Findings (4)

highRemote MCP server over unencrypted HTTP MCP-TRANSPORT-001

Confidence: high · static evidence
Where: server notes, ~/.cursor/mcp.json
Evidence: url http://notes.example.net/mcp
Why it matters: Over plain HTTP, anyone on the network path (coffee-shop Wi-Fi, a proxy, a compromised router) can read every prompt, tool result, and token, and can inject their own tool descriptions into what the model sees.
Fix: Use the server's https:// endpoint. If it has none, do not send it anything sensitive, or run it locally over stdio instead.

mediumFile access granted to your whole disk or home directory MCP-FS-001

Confidence: high · static evidence
Where: server filesystem, ~/.cursor/mcp.json
Evidence: filesystem allowed path: /
Why it matters: A filesystem server rooted at / or your home directory lets the model read SSH keys, cloud credentials, browser data, and every other project. One prompt injection from a web page or issue is enough to ask for them.
Fix: Grant only the project directories the assistant needs (for example the current repo), never / or ~.

mediumPlain-text secret in MCP config MCP-SECRET-001

Confidence: high · static evidence
Where: server github, ~/.cursor/mcp.json
Evidence: env GITHUB_PERSONAL_ACCESS_TOKEN=ghp_…[redacted 40 chars] (GitHub token)
Why it matters: Anything that can read this file, including other tools, backups, sync folders, and anyone the file is shared or committed with, gets a working credential. Assistants also read project files, so a key in a config can end up in a prompt or a log.
Fix: Rotate the credential first (removing it does not un-leak it), then reference it from the environment or a secret store instead of the literal value. Claude Code and Claude Desktop expand "${VAR}" in .mcp.json, Cursor expands "${env:VAR}", and VS Code supports "${input:...}" prompts or an "envFile".

mediumServer package version is not pinned MCP-SUPPLY-001

Confidence: high · static evidence
Where: server github, ~/.cursor/mcp.json
Evidence: npx @modelcontextprotocol/server-github
Why it matters: Without a pinned version, every client start can download and run whatever the publisher (or anyone who takes over the package) released last. A server you reviewed last month is not the server you are running today.
Fix: Pin an exact version you have reviewed (npx -y package@1.2.3, uvx package==1.2.3, image:tag or image@sha256:...), and re-scan after each deliberate upgrade.

Live findings (tool poisoning, invisible Unicode, shadowing, drift) need npx mcpvetter scan --live, which asks before starting each server.