MCP Security Snapshot is a read-only local scanner for Model Context Protocol projects. It checks source files for secret-like literals, private-key markers, dangerous eval or exec calls, declared remote MCP or API endpoints, and obvious dependency pinning gaps. It produces a Markdown and JSON evidence report with timestamps, severity, locations, evidence, and remediation actions. The scanner does not execute project code, make network calls, upload source files, or certify security. Use non-sensitive or redacted source only. This is a practical security triage snapshot, not a penetration test.