"GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_..." in a committed .mcp.json gives your token to everyone who can read the repository, and npx -y @modelcontextprotocol/server-github with no version runs whatever was published last, every time your editor starts the server. This skill finds those and eight other MCP config mistakes before you commit or load the config, and tells you how to fix each one.

Your agent runs a scanner on your MCP configs: Claude Code (.mcp.json, ~/.claude.json, plugin manifests), Claude Desktop, Cursor (.cursor/mcp.json), VS Code (.vscode/mcp.json with its servers and inputs), Windsurf, Cline, Roo Code and Gemini CLI (.gemini/settings.json). It accepts comments and trailing commas, knows each client's variable syntax (${VAR}, ${env:VAR}, ${input:id}, $VAR), and unwraps cmd /c, sh -c and powershell -Command to see the real command. It never starts a server, installs a package or connects to anything. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• M01: API keys, tokens, passwords and Bearer credentials written in env, headers, args, URLs or OAuth settings

• M02: remote servers over plain http:// or ws:// (not localhost, a private address or Tailscale)

• M03: a server command that pipes a download into a shell (curl | bash, iwr | iex)

• M04: Docker servers with --privileged, SYS_ADMIN, --pid=host, the host's / or the Docker socket mounted

REVIEW (check before release)

• M11: npx, uvx, pipx, bunx and pnpm dlx packages or Docker images without an exact version, or with @latest

• M12: servers installed from a git repo, a GitHub owner/repo shorthand or a tarball URL without a commit hash

• M13: filesystem servers or container mounts given /, a drive root or a home folder

• M14: autoApprove or alwaysAllow lists with * or write and run tools, and Gemini CLI's trust: true

• M15: TLS checks turned off (NODE_TLS_REJECT_UNAUTHORIZED=0, --ignore-https-errors and similar)

• M16: servers started with sudo, doas or runas

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (Claude Code, Cursor, VS Code, Roo Code and Gemini CLI configs), and the real report the scanner produces on the risky one

Limits

It reads each config as written: values filled in later (environment variables, env files, VS Code inputs, a client's settings screen), approval rules kept in other files, TOML or YAML configs such as Codex config.toml, and what a server's own code does are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 16 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (10 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.