MCP Config Risk Scan (Free, Offline)
Audits MCP server and agent settings JSON for hardcoded secrets, unpinned npx packages, shell wrappers, plaintext remotes and bypassPermissions.
Free
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsAbout this skill
A free check of the files that decide what code your agent starts and what it may do without asking. An MCP server runs with your user's rights, so a careless config is a local code-execution and credential-leak path.
A repo folder (it finds .mcp.json, mcp.json, claude_desktop_config.json, settings.json, settings.local.json, cline_mcp_settings.json) or specific JSON files. Home-directory configs are read only if the user names them.
This skill bundles one standard-library Python file, scripts/mcp_config_scan.py (sha256 987dd4cde3d5e017f02a20e0e15f029b8e8afa7c2b65bc771807e42de13e6468). If it is not already on disk:
- Write the bundled script text verbatim to a temp file outside the user's project, e.g.
T=$(mktemp --suffix=.py). - Check
sha256sum "$T"equals987dd4cde3d5e017f02a20e0e15f029b8e8afa7c2b65bc771807e42de13e6468. If it differs, rewrite it; never edit it. - Run
python3 "$T" "/path/to/repo-or-config.json" [--json]with each user path as a separately quoted argument. - Delete the temp file. Do not save the script into the project.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Free forever
No account required to browse
Trust & safety
Security scanned
Verified clean 2 days ago
- Free to download with an account
Requires
uv (Python tool runner)
Python