mcp-guard scan: one command audits MCP server configs across 8 AI coding clients
ErgoniaWorks · reddit · 2026-10-15
A developer shipped mcp-guard v0.9 with a scan command (uvx mcp-guard-audit scan) that reads MCP configs from all major clients at once — Claude Desktop, Claude Code (including per-project servers in /.claude.json), Cursor, VS Code, Windsurf, Zed, Continue and Cline/Roo — grouping findings by client and server, deduping servers configured twice.
- Checks include command execution (CRITICAL), broad filesystem scope (HIGH), hardcoded secrets (HIGH), insecure http transport (MEDIUM)
- Purely static: starts nothing, makes no network calls; tokens are reported by length and URLs keep only scheme+host so secrets never leak into output
- --json and OASIS-validated --sarif outputs for CI and GitHub code scanning; exit 0 by default, --fail-on high to gate builds
- MIT licensed; a few config paths remain unconfirmed and the author asks for corrections
More from coding & agent
- Laude Institute launches FrontierCS 2: agents must beat deleted paper contributions blind — lateinteraction · 2026-10-23
- Index Network open-sources Social Discovery Protocol: agents negotiate fit on your behalf — carsonfarmer · 2026-10-23
- Installed a formal-verification skill: it silently installed Java, MacBook runs 10 degrees hotter — zealcaiden · 2026-10-23
- OpenAI's Decisions API hits GA: near real-time routing up to 10x faster than GPT-6 Luna — OpenAIDevs · 2026-10-23
- Ruff author warns: upgrade Node/Bun now — --use-system-ca still accepts the eMudhra cert — charliermarsh · 2026-10-23
- Proof of Agent: paste one prompt and your AI mines, grades, and self-governs — adamamcbride · 2026-10-23