Check an MCP client config
scan_mcp_configCheck a pasted MCP client config (.mcp.json, claude_desktop_config.json, mcp.json, Codex config.toml). Reports each npm or PyPI launch by its position and how its version is pinned (exact, @latest, a tag or range, none), flags releases on the known-compromised list, and runs static analysis over the text. Server names, package names, arguments, env and header values are never returned or stored; remove secrets before sending anyway. Static analysis only; nothing is run or fetched. Returns a verdict (CLEAN, CAUTION, REVIEW, DO-NOT-INSTALL or NAME-NOT-PUBLISHED), the pinning advice and a permalink.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | The config file's text | |
| filename | No | The config's filename, ending in .json or .toml (default .mcp.json) |