Short answer: paste the MCP config your agent uses and this page flags the settings that most often cause trouble: keys written in plain text, unpinned packages, whole-disk file access, plain-HTTP remote servers, privileged containers and auto-approved tools. It runs entirely in your browser. This page makes no network requests, and its Content-Security-Policy (connect-src 'none') blocks them.
What it checks
| Check | Why it matters |
|---|---|
| Keys and tokens in plain text (env, headers, args, URL) | Config files get committed, synced and backed up. A key in the file is a key in every copy. |
Unpinned npx, uvx and container images | The server you run changes whenever a new release ships, including a hijacked one. |
Filesystem servers pointed at / or your home folder | The agent can reach SSH keys, browser profiles and every other project. |
Remote servers over http:// | Tokens and tool results travel unencrypted. |
--privileged, Docker socket, host networking | Each one gives the server close to full control of the machine. |
Shell one-liners, sudo | What runs is decided at launch time, with more power than any MCP server needs. |
| Command-running servers, auto-approved tools | Anything that writes, sends, spends or deletes should ask a person first. |
| Client quirks | For example, Claude Code skips a remote entry that has a url but no type. |
What it does not do
It reads the config text only. It does not start servers, fetch tool descriptions or look for prompt injection inside them. Scanners that do that have to launch the servers in your config, so run them in a sandbox. A clean result here means none of these patterns showed up, not that a server is safe.
Going further
- MCP & Tool-Access Review Kit ($29): a tool-access matrix, an MCP server intake checklist, an approval-gate policy and a script that flags risky rows.
- Agent Security Audit Kit ($79): 35 controls, evidence templates and a read-only MCP config scanner you run locally.
- Agent Secrets Exposure & Rotation Kit ($29): what to do after a key has been exposed.
Related free tool: Agent run-cost calculator.
Product names on this page are trademarks of their respective owners and are used only to say what Agent Field Kit works with. Agent Field Kit is independent and is not affiliated with, sponsored or endorsed by them.