Audit one mcp.json for what an agent config gives away — inline API keys, unpinned npx launches, plaintext remote servers, shell wrappers, auto-approved tools, whole-machine filesystem roots — with li (bundled Node.js runtime)
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"readystack-mcp-config-audit","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# MCP Server Config Audit > Runs the same checker as the npm package `@readystack/mcp-config-audit` on a Node.js runtime that pip installs for you (`nodejs-wheel-binaries`) - no system Node.js needed. Your files are checked locally. Audit one mcp.json for what an agent config gives away — inline API keys, unpinned npx launches, plaintext remote servers, shell wrappers, auto-approved tools, whole-machine filesystem roots — with line numbers. The shipped sample config _fixtures/dirty.mcp.json (33 lines, five servers) returns 14 findings, 8 of them blocking. ## Install ``` mcp-config-audit file ``` Node 18+. The same 18 rules as the VS Code extension, from a terminal or CI. ## Free - Audit one mcp.json against all 18 rules and get every inline credential, unpinned launch and over-broad grant named with its line number and its replacement. The extension ships a sample config, _fixtures/dirty.mcp.json, 33 lines and five servers, which returns 14 findings, 8 of them blocking, and its corrected twin _fixtures/clean.mcp.json, which returns zero. - `--rules` lists every rule ## With a licence ($29 once) - Audit every agent config in a repository and in the user-scope locations for VS Code, Cursor, Claude Desktop and Windsurf in one pass, fail CI with a non-zero exit code on any blocker, and export a dated evidence report of file, rule and line. ``` @readystack/mcp-config-audit --dir ./templates --report html --out report.html ``` Freelance application-security engineers commonly bill $100-$200 an hour; a single review hour costs more than three licences, and the config changes every time somebody adds a server. ## Use from an AI agent (MCP) Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config: ```json { "mcpServers": { "mcp-config-audit": { "command": "npx", "args": ["-y", "@readystack/mcp-config-audit", "--mcp"] } } } ``` Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line numbe…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.