MCPSec
Security scanner for Model Context Protocol (MCP) server configurations. Covers all 10 OWASP MCP Top 10 risk categories via pfrederiksen/mcpsec — an Apache 2.0 open-source Go binary.
⚠️ Trust Model & Security Considerations
This skill scans MCP config files that may contain API keys and tokens. Read this before installing.
Supply chain
The
mcpsec binary is an external artifact from GitHub. Mitigate supply chain risk by verifying the SHA256 before running — do not skip this step.
Pinned checksums for v1.0.0:
CODEBLOCK0
For stronger guarantees, build from source: INLINECODE1
Sensitive data access
MCP config files may contain API keys and tokens. The scanner reads them to detect hardcoded secrets (MCP04) but does not write, transmit, or log them. The wrapper script (
scan.py) makes no network calls. The binary makes no network calls per its source, but this skill cannot enforce the binary's runtime behavior — review the source or run in an isolated environment if you require certainty.
Network behavior
- - Wrapper script: no network calls
- mcpsec binary: no network calls per source; cannot be verified at runtime by this skill
Isolation
For high-security environments, run in a container or VM, or audit the mcpsec binary source before use.
Usage
CODEBLOCK1
Installing mcpsec
CODEBLOCK2
What It Scans
Auto-discovers configs at these paths:
- -
~/Library/Application Support/Claude/claude_desktop_config.json (Claude Desktop) - INLINECODE4 (DXT extensions)
- INLINECODE5 (Cursor)
- INLINECODE6 (VS Code)
- INLINECODE7 (custom)
OWASP MCP Top 10 Coverage
| ID | Risk | Severity |
|---|
| MCP01 | Prompt injection in tool descriptions | High |
| MCP02 |
Excessive tool permissions | Critical/High |
| MCP03 | Missing authentication | Critical/High |
| MCP04 | Hardcoded secrets in env vars | Critical |
| MCP05 | Unsafe resource URIs (SSRF) | High |
| MCP06 | Tool definition spoofing | High/Medium |
| MCP07 | Insecure transport (HTTP, weak TLS) | Critical/High |
| MCP08 | Missing input validation schemas | Medium |
| MCP09 | Missing logging/audit config | Medium/High |
| MCP10 | No rate limiting | Medium |
Security Design (wrapper script)
- -
subprocess used exclusively with INLINECODE9 - All file paths validated against an allowlist pattern before use
- All exceptions caught by specific type — no bare INLINECODE10
- Full type hints and docstrings throughout
- Read-only — no config files are modified
System Access
- - Reads: MCP config JSON files at known paths (or paths you specify)
- Executes:
mcpsec scan binary — reads local config files only; no network calls per upstream source, but this cannot be enforced by the wrapper - No writes, no network calls from the wrapper script
- Sensitive data note: config files may contain API keys or tokens; mcpsec reads them to detect hardcoded secrets but does not transmit them
Requirements
- - Python 3.10+
- INLINECODE12 binary on PATH — see install instructions above
MCPSec
模型上下文协议（MCP）服务器配置的安全扫描器。通过 pfrederiksen/mcpsec（一个 Apache 2.0 开源 Go 二进制文件）覆盖全部 10 个 OWASP MCP Top 10 风险类别。
⚠️ 信任模型与安全考量
此技能会扫描可能包含 API 密钥和令牌的 MCP 配置文件。安装前请阅读以下内容。
供应链
mcpsec 二进制文件是来自 GitHub 的外部制品。通过在运行前验证 SHA256 来降低供应链风险——请勿跳过此步骤。
v1.0.0 的固定校验和：
e367cce46b1a152ccc8aedf2eeca5c6bcf5523b379a00a3f3704d61bf2b4fbca linux_amd64
98e6ccf883b3a40cea817e19cecd5dc66ae1816bdaf0a58f7fcd8a46576321b0 linux_arm64
5ab2db3cc517f67600ace32f6dfacb15b2ce0b77319797a0431b105466379f3b darwin_amd64
a9ea3b8d753f0332ddc7720a9778f870f42f523b589d12d8eed5030befa52ee9 darwin_arm64
如需更强保障，请从源码构建：git clone https://github.com/pfrederiksen/mcpsec && cd mcpsec && make build
敏感数据访问
MCP 配置文件可能包含 API 密钥和令牌。扫描器会读取它们以检测硬编码密钥（MCP04），但不会写入、传输或记录它们。包装脚本（scan.py）不进行任何网络调用。根据其源码，二进制文件也不进行任何网络调用，但此技能无法强制执行二进制文件的运行时行为——如需确定性保障，请审查源码或在隔离环境中运行。
网络行为
- - 包装脚本： 无网络调用
- mcpsec 二进制文件： 根据源码无网络调用；此技能无法在运行时验证
隔离
对于高安全环境，请在容器或虚拟机中运行，或在使用前审计 mcpsec 二进制文件源码。
使用方法
bash
自动发现并扫描所有已知的 MCP 配置位置
python3 scripts/scan.py
扫描特定配置文件
python3 scripts/scan.py ~/Library/Application\ Support/Claude/claude
desktopconfig.json
仅显示严重和高危发现
python3 scripts/scan.py --severity critical,high
JSON 输出（用于仪表板/SIEM）
python3 scripts/scan.py --format json
静默模式：仅在存在发现时输出（适合 cron 任务）
python3 scripts/scan.py --quiet
安装 mcpsec
bash
macOS（Homebrew — tap 由 pfrederiksen 维护）
brew install pfrederiksen/tap/mcpsec
Linux amd64 — 解压前验证 SHA256
curl -L https://github.com/pfrederiksen/mcpsec/releases/download/v1.0.0/mcpsec
1.0.0linux_amd64.tar.gz -o mcpsec.tar.gz
echo e367cce46b1a152ccc8aedf2eeca5c6bcf5523b379a00a3f3704d61bf2b4fbca mcpsec.tar.gz | sha256sum -c -
仅当上述命令输出 mcpsec.tar.gz: OK 时才继续
tar -xzf mcpsec.tar.gz && mv mcpsec /usr/local/bin/mcpsec && chmod +x /usr/local/bin/mcpsec
从源码构建（最强的供应链保障）
git clone https://github.com/pfrederiksen/mcpsec && cd mcpsec && make build
sudo mv mcpsec /usr/local/bin/
扫描内容
自动发现以下路径的配置：
- - ~/Library/Application Support/Claude/claudedesktopconfig.json（Claude Desktop）
- ~/Library/Application Support/Claude/Claude Extensions/（DXT 扩展）
- ~/.cursor/mcp.json（Cursor）
- ~/.vscode/mcp.json（VS Code）
- ~/.openclaw/workspace/mcp-config.json（自定义）
OWASP MCP Top 10 覆盖范围
| ID | 风险 | 严重程度 |
|---|
| MCP01 | 工具描述中的提示注入 | 高 |
| MCP02 |
过度的工具权限 | 严重/高 |
| MCP03 | 缺少身份验证 | 严重/高 |
| MCP04 | 环境变量中的硬编码密钥 | 严重 |
| MCP05 | 不安全的资源 URI（SSRF） | 高 |
| MCP06 | 工具定义欺骗 | 高/中 |
| MCP07 | 不安全的传输（HTTP、弱 TLS） | 严重/高 |
| MCP08 | 缺少输入验证模式 | 中 |
| MCP09 | 缺少日志/审计配置 | 中/高 |
| MCP10 | 无速率限制 | 中 |
安全设计（包装脚本）
- - 仅使用 subprocess 且 shell=False
- 所有文件路径在使用前均通过允许列表模式验证
- 所有异常均按特定类型捕获——无裸 except
- 全程包含完整类型提示和文档字符串
- 只读——不修改任何配置文件
系统访问
- - 读取： 已知路径（或您指定的路径）下的 MCP 配置 JSON 文件
- 执行： mcpsec scan 二进制文件——仅读取本地配置文件；根据上游源码无网络调用，但包装器无法强制执行此行为
- 无写入，包装脚本无网络调用
- 敏感数据说明： 配置文件可能包含 API 密钥或令牌；mcpsec 读取它们以检测硬编码密钥，但不会传输它们
要求
- - Python 3.10+
- mcpsec 二进制文件在 PATH 中——参见上方安装说明
