MCPVetter

com.mcpvetterPublished by mcpvetter.comOfficial publisherv0.1.3Updated Nov 7, 2026

Audit your MCP servers for poisoned tools and leaked secrets, and check AI-generated code for flaws.

VerifiedStreamable HTTPWeb executable

Overview

MCPVetter's hosted MCP server (mcpvetter.com), published by mcpvetter.com; OAuth sign-in required; Streamable HTTP; 7 tools.

No AI overview yet: these facts come from the registry entry and the server itself.

Publisher
mcpvetter.com
Endpoint
mcpvetter.com
Documentation
mcpvetter.com
Last checked

Installation

In SourceWeft

  1. Open MCPVetter in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.mcpvetter%2Fmcpvetter/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "mcpvetter": {
      "type": "http",
      "url": "https://mcpvetter.com/mcp"
    }
  }
}

README

mcpvetter

Audit the MCP servers your AI assistant uses: leaked secrets, unpinned or look-alike packages, risky launch commands, unencrypted remote servers, over-broad file access, poisoned tool descriptions, hidden Unicode, tool shadowing, and silent tool changes.

bash
npx mcpvetter scan          # discover + static scan, offlinenpx mcpvetter scan --live   # also read each server's tool descriptions (asks first)

Local, no account, no telemetry. A static scan reads your MCP config files and nothing else. It never changes a config file.

What a finding looks like

■ github[HIGH] Plain-text secret in MCP config  MCP-SECRET-001 · confidence high · static    server: github  file: .mcp.json    Evidence: env GITHUB_PERSONAL_ACCESS_TOKEN=ghp_…[redacted 40 chars] (GitHub token)    Why it matters: Anything that can read this file, including other tools, backups, sync    folders, and anyone the file is shared or committed with, gets a working credential.    Fix: Rotate the credential first (removing it does not un-leak it), then reference it    from the environment or a secret store instead of the literal value. Claude Code and    Claude Desktop expand "${VAR}" in .mcp.json, Cursor expands "${env:VAR}", and VS Code    supports "${input:...}" prompts or an "envFile".

Every finding has a stable ID, separate severity and confidence, redacted evidence, a plain-English reason, and a concrete fix. What each rule checks, and how, is published at mcpvetter.com/rules and in src/scanner/rules.

Clients discovered

Claude Code (~/.claude.json, .mcp.json), Claude Desktop, Cursor (~/.cursor/mcp.json, .cursor/mcp.json), VS Code (mcp.json, settings.json, .vscode/mcp.json), Windsurf, Gemini CLI. Or pass --config <file>.

Commands

mcpvetter scan [--live] [--yes] [--config <file>]... [--json [file]] [--summary] [--fail-on <severity>]mcpvetter list                               inventory onlymcpvetter explain MCP-POISON-001             explain a findingmcpvetter rules                              every rule and what it checksmcpvetter suppress <ID> --server <name> --reason "<why>"mcpvetter accept <server> --reason "<why>"   accept a server's new tool fingerprintmcpvetter serve                              run as a local MCP server (stdio)

Exit codes: 0 no findings at or above --fail-on (default high), 1 findings at or above it, 2 scan could not complete. Use it in CI as-is.

Suppressions are always listed in the report, so a shared report cannot hide them.

About --live

To read tool descriptions, MCPVetter has to start each stdio server, exactly as your AI client does every time it launches. It asks before each one, runs it with a minimal environment plus the env your config declares, and only calls initialize, tools/list, prompts/list, and resources/list. It never calls a tool. The first approved probe records a fingerprint of each server's tools in ~/.mcpvetter/fingerprints.json; later probes report any change (a "rug pull") with a before/after diff.

Inside your AI assistant

Claude Code:

bash
claude mcp add mcpvetter -- npx -y [email protected] serve

Cursor / VS Code / Claude Desktop (mcpServers or servers):

json
{ "mcpServers": { "mcpvetter": { "command": "npx", "args": ["-y", "[email protected]", "serve"] } } }

Then ask: "audit my MCP setup".

Free without an account: check_mcp_setup, explain_finding. With an API key (MCPVETTER_API_KEY, free tier available at mcpvetter.com/account): review_code, secure_pattern, start_lab, check_lab, team_posture. Code review runs on your machine; only rule IDs and counts are sent for your history. Plans: mcpvetter.com/pricing.

Privacy

  • Static analysis runs on your machine. Without an API key, MCPVetter makes no network requests.
  • With an API key, only rule IDs, severities, and counts are sent. Never code, evidence, file paths, or server names.
  • Reports redact secret values by default.

License

MIT

Source: README.md at commit cffd157

Tools

7

review_code

Review code for security flaws

Check a code snippet for security flaws before presenting or committing it. Call this before showing the user any generated code that handles authentication, sessions, database queries, user or LLM input, HTML rendering, file uploads, outbound URL fetches, secrets, or MCP configuration. Returns prioritised findings, each with evidence, a concrete fix, and a 5-minute lab. Analysis is static and deterministic; it checks at the moment of generation and is not a guarantee.

Parameterscoderequiredfilenamelanguageai_generated

explain_finding

Explain a security finding

Explain an MCPVetter finding in plain English: why it matters, how the flaw is triggered (in general, defensive terms), why a code reviewer would block it, and how to fix it. Call this when the user asks what a finding ID (like CODE-SQLI-001 or MCP-POISON-001) means or why it matters.

Parametersidrequired

secure_pattern

Get the secure version of a coding pattern

Return a vetted secure code example for a pattern in the user's stack, the insecure version to avoid, and a reviewer checklist. Call this when writing code for: database queries, secrets/API keys, login and sessions, rendering user content as HTML, sending user input to an LLM, using LLM output, file uploads, fetching URLs/webhooks, or configuring MCP servers. Example requests: "parameterised query in Node", "safe handling of LLM output in Python".

Parametersstackrequestrequired

start_lab

Start a 5-minute secure-coding lab

Start a short hands-on lab that fixes one vulnerability in realistic AI-generated code. Call this when the user wants to learn how to fix a finding, or after review_code reports a finding with a lab. Pass a lab id (lab-02-sqli) or a finding id (CODE-SQLI-001). Then help the user fix the snippet and submit it with check_lab.

Parameterslab_idfinding_id

check_lab

Check a lab solution

Verify a fixed snippet for a lab started with start_lab. Runs the lab's security checks on the code and records progress. Call this when the user says their lab fix is ready.

Parameterscoderequiredlab_idrequired

check_mcp_setup

Audit MCP server setup

Audit the MCP servers configured on this machine (Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI) for leaked secrets, unpinned or look-alike packages, risky launch commands, unencrypted remote servers, over-broad file access, and dangerous server combinations. Call this when the user asks whether their MCP setup or a server is safe. Static and local; for tool-description poisoning run `npx mcpvetter scan --live` in a terminal.

Parametersconfig

team_posture

Team security posture

Team plan: aggregated, de-identified counts of recurring code findings, MCP risk by category, and lab completion for the user's team over the last 30 days. No code or per-developer detail. Call this when a team lead asks how exposed the team is or which flaws keep recurring.

Takes no parameters.

Version history

1
  1. v0.1.3LatestNov 3, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts