Mception

Audits other MCP servers for security risks and returns a safe, caution, unsafe, or inconclusive verdict.

What you can do

Mception inspects other MCP servers and reports security risks, returning a verdict of safe, caution, unsafe, or inconclusive. It stores audit reports and rug-pull baselines in a data directory, and can optionally use an advisory LLM-assisted classification step through MCP sampling. It also supports an offline mode that blocks outbound HTTP checks.

When to use it

Useful when you are evaluating or vetting MCP servers before installing them, or when you want to re-check a server you already use for changes that could indicate a rug-pull. It fits review and due-diligence workflows rather than day-to-day task automation.

Requirements

Runs locally as a Python package over stdio. Optional environment variables: MCEPTION_DATA_DIR for where reports and baselines are stored (defaults to ~/.mception), MCEPTION_ENABLE_LLM_JUDGE to enable the advisory LLM judge, MCEPTION_INTROSPECT_TIMEOUT for the per-target timeout, and MCEPTION_OFFLINE to block outbound HTTP. No authentication is declared.