MCP config auditor
Check Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and Gemini CLI MCP configs for leaked secrets, unpinned servers and risky permissions, before you roll them out. Everything runs in your browser.
- 20 rules
- 6 clients
- 0 uploads
- SARIF for CI
Prefer the terminal? npx @qlucent/mcp-audit finds and checks the configs on your machine. v0.1.0 · Suggest a rule
Runs in your browser. Nothing is uploaded.
That doesn't make it safe: this checks the config, not what the servers' code does.
FAQ
Does my config get uploaded?
No. The audit runs in your browser, and the page's Content Security Policy blocks all network requests (connect-src 'none'), so nothing you paste or drop can leave the page. Nothing is uploaded or kept: opening the full report from the landing page passes your config within this tab, and it is deleted as soon as the auditor reads it.
Which files can I check?
Claude Desktop (claude_desktop_config.json), Cursor (.cursor/mcp.json), VS Code (.vscode/mcp.json, or the mcp block in your user settings.json), Windsurf, Gemini CLI, Claude Code (.mcp.json, ~/.claude.json and settings.json), or any JSON with an mcpServers block. Comments and trailing commas are fine. You can drop several files at once.
How is this different from mcp-scan?
mcp-scan connects to your servers and inspects the tool descriptions they return. This auditor only reads the config file, so it never starts a server or makes a request. It catches leaked secrets, unpinned packages, risky permissions and dangerous server combinations before you roll a config out.
Can I run it in CI?
Yes. Run npx @qlucent/mcp-audit in your pipeline. It uses the same rules, exits non-zero on high or critical findings (--fail-on high by default), and can write SARIF for GitHub code scanning.