MCP security scanner & config linter for AI coding agents. Finds leaked secrets, risky commands, broad permissions and invalid MCP servers in Claude Code, Cursor and VS Code (Copilot) configs. Local-f
AgentConfig Doctor: MCP and AI Coding-Agent Config Security Scanner
Catch leaked keys, dangerous commands and over-broad permissions in your AI coding-agent configuration before you commit or share it.
AgentConfig Doctor is an open-source MCP security scanner and config linter for Claude Code, Cursor and VS Code (GitHub Copilot). This local-first CLI checks .mcp.json, .cursor/mcp.json, .vscode/mcp.json, .claude/settings.json, Cursor rules, CLAUDE.md and AGENTS.md for:
- exposed secrets and API keys - risky shell commands, such as curl sh in hooks or MCP servers - broad filesystem permissions - invalid or suspicious MCP server definitions - permission changes in pull requests
Every finding explains what it saw, why it matters and how to fix it. It needs no AI API and no account, sends no telemetry, and never runs the commands it inspects.
Use it to: validate an MCP config file, audit Claude Code permissions, lint Cursor MCP servers, scan AI agent configs for secrets in CI, or review a repository's agent setup before you trust it.
Status: 0.1.0, pre-release. The CLI is feature-complete for its first release and tested, but has not been published to npm yet. Until then, run it from source.
- Demo - Installation - Quick start - Supported configuration files - Rules - Baselines and permission-change detection - GitHub Actions - Output formats and exit codes - Configuration - Security model and privacy - Known limitations - Roadmap - Contributing - Troubleshooting - FAQ - License and acknowledgements
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/vasikmansuri--agentconfig-doctor.html)
Fast single-binary security scanner for MCP (Model Context Protocol) servers — config audit, live capability enumeration, tool-poisoning detection & risk grading. Zero deps, fully offline — trivy for
12122J/mcpvetMCP security scanner — vet a Model Context Protocol server before you add it to Claude Code, Cursor, or Windsurf. Grades it A–F, catching credential theft, tool-poisoning, and install-script payloads
agent-chaperone/agent-chaperoneScreens an AI agent's tool calls before they run and tool results before the agent reads them. An MCP proxy plus a hooks adapter for a client's built-in tools.
pranee54/AgentDoctorLocal CLI that audits coding-agent configuration for security, instructions, context, and MCP — no API key or code upload by default.
yagyeshVyas/VibeGuardFree security & privacy scanner for AI-coded apps. 699 rules, 76 MCP tools, 13-layer defense, zero-trust sandbox, AI firewall. Runs locally, never sends data anywhere. Scan your AI-generated app for l
kdev1966/Handoff-CLIShared, persistent memory for your AI coding assistants (Claude Code, Copilot, Cursor, Gemini CLI, Codex…): a local MCP server and CLI that hand work over between tools automatically.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.