01
MCP config auditor v0.1.0
- 20 rules covering plaintext secrets, unpinned servers, shell execution, broad filesystem roots, plain-HTTP remotes and allow-all permissions.
- Reads Claude Desktop, Claude Code, Cursor, VS Code (including user settings.json), Windsurf and Gemini CLI configs.
- Flags dangerous combinations of tools, such as reading untrusted content while also able to send data out.
- Secrets are masked in every output.
- Exports Markdown and SARIF reports.
- Run it locally with npx @qlucent/mcp-audit, which finds well-known config files automatically.