MCP configuration scan
Is your MCP setup leaking?
sievant scan reads the MCP server configuration of Claude Desktop, Claude Code, Cursor, VS Code and Windsurf, plus the project files in the current directory. It never changes them.
What a finding looks like
Risky client configurations, before anything runs. Secrets are masked in every output.
With --inspect-tools it also starts each server and runs the prompt-injection detector over every tool's name, title and description. Starting a server runs its code, so it is never the default.
CRITICAL SEC001 github env.GITHUB_PERSONAL_ACCESS_TOKEN: Hard-coded GitHub tokenHIGH PERM001 files args[2]: Access to the whole filesystemHIGH SUP002 installer args: Server launched by a script downloaded at startWhat it finds
| Rule | Severity | Finds |
|---|---|---|
| SEC001 | critical | a credential in a recognizable format (GitHub, GitLab, Slack, Anthropic, OpenAI, Stripe, AWS, Google, Hugging Face, npm, Notion, Linear, private keys, JWTs, database URLs with a password) in env, args or headers |
| SEC002 | high | a literal value in a secret-named variable, header or flag |
| SEC003 | critical | a password in a server URL |
| SEC004 | high | a credential embedded in a URL's path or query (a "capability URL": UUID or high-entropy path segments, token-bearing query keys such as key, token, api_key, user_id, or a path on a known capability-URL provider), in url or in args |
| PERM001 / PERM002 | high / medium | the filesystem root / the whole home directory given to a server |
| PERM003 | medium | all permissions (Deno), host network, privileged container |
| SUP001 | medium | an unpinned package or image, or a moving tag (@latest) |
| SUP002 | high | a server fetched from a git repository or URL, or launched by a downloaded script (curl … | sh) |
| AUTH001 | medium | a remote server with no credential configured (it may still use OAuth) |
| NET001 | high | a remote server over plain HTTP |
| INJ001 | high/medium | with --inspect-tools: a tool description that reads like instructions to the model |
| MCP001 | info | with --inspect-tools: resources and prompts Sievant would withhold |
| MCP002 | info | with --inspect-tools: tools that need MCP tasks, on a server that does not declare tasks (docs/compatibility.md) |
| SVT001 / SVT002 | info | already launched through Sievant / could not be inspected |
From the Sievant repository: docs/scan-and-wrap.md at commit 8529db1.
See how Sievant rates findings and the full scan and wrap guide.
Reports, and a gate for CI
sievant scan --fail-on high exits with code 3 when a finding is high or worse, so CI can stop on it.
sievant scansievant scan --json > scan.jsonsievant scan --html scan.htmlsievant scan --fail-on highLaunching soon
Sievant isn’t released yet
Install commands will appear here on release day. Until then, book a call to talk through your setup, or email us.
Found something? Want it reviewed?
The Agent Security Review goes past configuration: a threat model, Sievant deployed in front of your agents (observe first, then enforce) and a posture report for your customer’s security review.
From $7,500, 1–2 weeks.