Skip to main content

Free scanner

MCP readiness scanner

Severity-ranked readiness signals from your MCP configuration — analysed passively, in your browser. No upload, no execution, no network contact without your explicit consent.

Run a scan

A client mcpServers block, a .vscode/mcp.json, or a single server entry. Redact secrets first — redaction does not affect the analysis, and nothing you paste leaves your browser.

The example is synthetic — it contains deliberately flawed settings and no real credentials. Tick the box above to enable the analysis.

Transparency

Exactly what the scanner does — and does not do

Checks performed on configuration

  • Configuration validity. Whether the configuration parses and matches a recognised MCP configuration shape.
  • Transport & session pattern. stdio vs HTTP transport declarations, deprecated SSE-style endpoints and session assumptions that block stateless deployment.
  • Endpoint scheme. Remote server endpoints using plain http:// (outside localhost), raw IP addresses and other transport-hygiene signals.
  • Credential exposure. Inline tokens, API keys and secret-looking values embedded in configuration instead of referenced from a secret store.
  • Package launch hygiene. Auto-installing launchers (npx -y / uvx with unpinned packages), @latest version references and unpinned container images.
  • Filesystem & argument scope. Filesystem-server arguments granting overly broad paths (drive roots, home directories) and other wide-scope launch arguments.
  • Authorization signals. Whether remote servers declare an authorization approach at all, and whether shared static headers stand in for per-user identity.

What it will never do

  • It never executes your code, installs packages or launches the servers in your configuration.
  • It performs no network requests in configuration mode — analysis runs entirely in your browser and nothing you paste is uploaded or stored.
  • It does not probe live endpoints without your explicit, separate consent — and only when a probe backend is available.
  • It is not a penetration test, a certification, or a complete security review, and its findings are limited to what static configuration can reveal.
  • It never creates, changes or proves ECZ-ID state. Verification of ECZ-ID proof is the Resolver's job, not the scanner's.

Privacy & retention

  • Configuration analysis runs locally in your browser. Pasted content is not transmitted, logged or retained by EcoCitizenz.
  • Analytics records only that a scan ran and the count of findings by severity — never the content of what you scanned.
  • If you download the report, the file is generated in your browser and saved directly to your device.

Verifying ECZ-ID proof is a different job with a different tool: the free, open-source local verifier @ecocitizenz/ecz-id-mcp-verifier checks public Resolver state and never writes truth. This scanner assesses MCP configuration readiness; neither tool certifies anything, and neither creates authoritative state.