Free tool
MCP Server Security Linter
Paste a Model Context Protocol server config (an mcpServers block, a single server entry, or a tools/list response) and get instant static-analysis findings: hard-coded secrets, dangerous tool capabilities, unconstrained parameters that invite SSRF or injection, missing authentication, and plaintext transport. It runs entirely in your browser — the config never leaves your machine and the MCP server itself is never contacted.
100% in your browser — the config you paste is never uploaded, and this tool never contacts the MCP server (no SSRF).
What it checks
- Secrets hard-coded in env, args, or headers (API keys, tokens, private keys).
- Dangerous tool capabilities — exec/shell/eval, file, network, and database access.
- Unconstrained free-form parameters (command / url / sql / path) that enable SSRF, injection, or traversal.
- Remote endpoints with no visible authentication header.
- Plaintext transport (http://) and endpoints pointing at internal / metadata addresses.