I scanned my own laptop: 6 AI agents, 14 MCP servers, 12 unpinned, 5 plaintext keys

I have six AI agents installed on one laptop: Claude Code, Cursor, Codex, OpenCode, OpenClaw and DeepSeek Harness. Between them they run 14 MCP servers.

I wrote a read-only scanner to answer a question none of them could answer on their own: what can all of my agents touch, together?

It finished in 0.19 seconds. This is what came back.

Finding 1: 12 of the 14 MCP servers are unpinned

context7   -> npx @upstash/context7-mcp                (unpinned)
playwright -> npx @playwright/mcp@latest               (@latest)
github     -> npx @modelcontextprotocol/server-github  (unpinned)
... 12 in total

Every npx -y <package> is a supply-chain decision. @latest means the code that runs at startup is whatever was published to npm most recently — not the version you tested. My GitHub MCP server holds a personal access token and pulls @latest on every start.

This is not theoretical. 2025 already had real malicious MCP packages on npm harvesting .env files.

Finding 2: five API keys sit in plaintext in agent config files

The scanner masks values and never prints them. But the values are there, in plaintext, on disk.

Any process — or any agent — that can read those files has my GitHub and OpenAI accounts. This is close to the default configuration on most developer machines right now.

Finding 3: six agents, no inventory

Cursor knows its own permissions. OpenClaw knows its own. Nothing answers "what can all of my agents do together?" That is the shadow-agent problem, and it is why the scan report matters more than any single finding in it.

What I changed

1. Pin versions. npx -y [email protected], never @latest.
2. Move secrets to a keychain. Tokens out of agent config files and into a system keychain or secret manager.
3. Put a gate in front of tool calls. A policy layer that denies sensitive paths, blocks secret output, and hash-chains every call for audit.

Run the scan yourself

Read-only, offline, nothing uploaded, secrets masked in the report:

curl -fsSL https://gitee.com/suhuisoftwares/pod/raw/v0.3.2/scripts/install.sh | sh
pod scan

Apache-2.0. Local-first.

Repo: https://gitee.com/suhuisoftwares/pod (mirror: https://github.com/suhui-organization/pod)
Site: https://podsec.vercel.app

The numbers come from a real scan of the author's machine (first scan 2026-09-01, re-confirmed 2026-09-12). No key values are published — run pod scan to get your own.