We built a client-side security linter for Model Context Protocol (MCP) and AI Agent configs

With the rapid adoption of the Model Context Protocol (MCP) and autonomous agent frameworks (like LangGraph and AutoGen), developers are wiring LLMs directly to local filesystems, databases, and production tools.

The problem? It’s dangerously easy to give an agent too much power—such as unpinned npx execution, broad root directory mounts, hardcoded API secrets, or raw SQL execution privileges without human-in-the-loop (HITL) gates.

To help developers audit their agentic stacks before deployment, I built a free, open-source utility: the MCP & AI Agent Security Scanner.

🔒 Why Client-Side SAST Matters for AI Configs

When dealing with proprietary mcp.json server configurations, production database URIs, or internal system prompts, sending configuration files to a third-party SaaS security scanner is a non-starter for security-conscious teams.

That's why the scanner runs entirely in your browser memory via static analysis (SAST):

• 100% Air-Gapped: Zero telemetry, zero network requests, and zero data leaves your local machine.
• Instant Feedback: Parses JSON, YAML, or plain text prompts on the fly.
• CVSS-AI Scoring: Calculates an exposure rating and generates a clean Markdown audit report in one click.

🛠️ What Vulnerability Patterns Does It Catch?

The linter scans for common high-risk misconfigurations mapped directly to the OWASP LLM Top 10 (specifically LLM06: Excessive Agency and LLM01: Prompt Injection):

1. Unrestricted Shell / Host Command Execution (ARL-MCP-001): Detects direct shell spawns (bash, sh, npx with --allow-all) without containerization or microVM sandboxing.
2. Root Filesystem or Broad Volume Mounts (ARL-MCP-002): Flags configurations exposing sensitive root paths (/etc/, /, C:\) to filesystem MCP servers.
3. Hardcoded Secrets (ARL-MCP-003): Spots plaintext API keys (sk-proj-..., GitHub tokens, AWS keys) sitting directly inside JSON environment blocks.
4. Unconstrained Database Mutations (ARL-MCP-004): Catches raw SQL execution tools or database roles with write privileges (readOnly: false) missing parameterization.
5. Arbitrary URL Fetching / SSRF (ARL-MCP-005): Identifies unrestricted web scraping or fetch tools that open up data exfiltration vectors via indirect prompt injection.
6. Missing HITL Confirmation Gates (ARL-MCP-007): Flags high-impact tools marked with alwaysAllow that bypass human confirmation for state-mutating actions.

🚀 Try It Live

You can test it right now against your own configs or load the built-in vulnerable sample to see how it flags risky tool bindings:

🔗 Try the MCP & AI Agent Security Scanner on Adversarial RL

💡 How to Fix Insecure MCP Configs (Quick Checklist)

If your local linter flags critical issues, follow these remediation steps:

• Isolate Tools: Run your MCP servers inside ephemeral microVMs (Firecracker or gVisor) rather than exposing direct host binaries.
• Enforce Read-Only Scopes: Restrict filesystem MCP servers to dedicated workspaces with strict read-only defaults.
• Use Secret Managers: Inject OAuth tokens and API keys at runtime via environment vaults rather than hardcoding them in mcp.json.

I’d love to hear your feedback or pull requests for additional regex rules—feel free to test it out and let me know what rules you'd like to see added next!