--- title: "MCP install security checker and command scanner" canonical: https://wavect.io/tools/mcp-install-risk-scanner/ language: en description: "Scan MCP install commands and config for risky shell execution, secrets, privileges, unpinned packages, sensitive paths, endpoints, and containers locally." image: "https://wavect.io/img/general/bak/open_graph_preview.jpg" --- BROWSER-LOCAL MCP INSTALL REVIEW # Read the command before you give an MCP server your machine. Paste an npx, uvx, Docker, PowerShell, shell, or MCP JSON snippet. The scanner flags observable risk patterns, redacts evidence, and explains what deserves review without executing or uploading anything. [Scan a snippet](#tool-app) Chrome Web Store review pending [View source](https://github.com/wavect/mcp-install-risk-scanner) - Rules 14 deterministic checks - Processing Local and offline - Version Open source v0.1.0 - Verdict Signals, not certification **INSTALL REVIEW** MCP CONFIG · STATIC TEXT **3 signals need review** Local analysis · nothing executed THE DIRECT ANSWER To check whether an MCP install command is risky, inspect the exact command for downloaded code execution, elevated privileges, destructive operations, sensitive paths, embedded credentials, moving package versions, insecure endpoints, and broad container access before running it. This scanner performs that static review locally, but it cannot prove that an unflagged package is safe. INSPECT THE EXACT SETUP ## MCP install inspection bench Paste the complete startup command or configuration, including arguments, environment entries, mounts, and URLs. Partial snippets produce partial evidence. Nothing leaves this tab **MCP install inspection bench** Static · deterministic · browser-local Load sample Scan locally 01 ### Command or MCP configuration Waiting for input Command or MCP configuration Shortcut: Ctrl or Command + Enter. Maximum input: 100,000 characters. 02 ### Risk signals Not scanned Scan a complete setup snippet to reveal deterministic findings and redacted evidence. Scan result 03 ### Redacted evidence and exports Static pattern matching is a review aid, not a malware verdict or safety certificate. Analysis stays in this browser tab No command execution or URL fetching Evidence is redacted before export Core v0.1.0 THE SAME RULES WHILE YOU BROWSE ## Review selected setup text before it reaches your terminal. The Manifest V3 extension scans selected text or visible setup blocks with the same tagged core. It asks only for temporary active-tab access after your click and never runs in the background across every site. Chrome Web Store review pending [Download v0.1.0](https://github.com/wavect/mcp-install-risk-scanner/releases/tag/v0.1.0) [Inspect source](https://github.com/wavect/mcp-install-risk-scanner) **MCP Install Risk Scanner** Chrome extension · v0.1.0 - activeTab, scripting, and contextMenus only - No host permissions or browsing history - No telemetry, upload, or remote rules THREE REVIEW MOVES ## How to check an MCP install command before running it Static analysis is most useful before execution, while the full command and requested privileges are still visible. 1. 01 - **Paste the complete setup** - Include command, arguments, environment values, URLs, mounts, and container flags. The scanner never executes them. 2. 02 - **Review every signal in context** - A match is evidence to inspect, not proof of malicious intent. Confirm why each privilege, path, endpoint, or moving dependency is necessary. 3. 03 - **Pin, narrow, and document** - Prefer immutable versions, explicit arguments, task-specific paths, scoped secrets, and isolated network access. Export the redacted report for review. VERSIONED RULE METHODOLOGY ## What the MCP command scanner actually checks Version 0.1.0 applies 14 ordered, deterministic rules. There is no model judgment, reputation lookup, package download, or hidden score. MCP001 ### Piped download execution Flags curl, wget, or PowerShell download output sent directly to a command interpreter. MCP002 ### Shell wrappers Flags sh -c, bash -c, PowerShell Command or EncodedCommand, and cmd /c boundaries. MCP003 ### Elevated privileges Flags sudo, doas, and runas because the server would inherit broader operating-system power. MCP004 ### Destructive deletion Flags recursive forced deletion syntax across shell, PowerShell, and Windows commands. MCP005 ### Weakened boundaries Flags world-writable permissions, disabled sandboxes, unconfined security profiles, and disabled enforcement. MCP006 ### Sensitive host paths Flags SSH, cloud, Kubernetes, root, system credential, and Docker-socket locations. MCP007 ### Inline secrets Flags common credential assignments, bearer tokens, provider token shapes, CLI secret arguments, and credential URLs, then redacts the evidence. MCP008 ### Unpinned runners Flags npx and uvx package execution without an exact semantic version. MCP009 ### Moving Git references Flags unpinned clones and branch-like dependency references such as main, master, or HEAD. MCP010 ### Floating container images Flags latest, missing tags, and image references without an exact version or digest. MCP011 ### Risky endpoints Flags remote HTTP plus private, link-local, and cloud metadata destinations while allowing explicit loopback development URLs. MCP012 ### Broad environment access Flags whole environment files, process.env inheritance, wildcard env declarations, and envFrom. MCP013 ### Privileged containers Flags privileged mode, host-root mounts, and Docker-socket mounts. MCP014 ### Host networking Flags Docker, Compose, and Kubernetes host-network modes. **Primary references** [MCP Security Best Practices](https://modelcontextprotocol.io/docs/2025-11-25/tutorials/security/security_best_practices#local-mcp-server-compromise) [Chrome activeTab permission](https://developer.chrome.com/docs/extensions/develop/concepts/activeTab) [Chrome Web Store quality guidelines](https://developer.chrome.com/docs/webstore/program-policies/quality-guidelines) [Versioned rule catalog](https://github.com/wavect/mcp-install-risk-scanner/blob/v0.1.0/schema/rules.json) [Scan report schema](https://github.com/wavect/mcp-install-risk-scanner/blob/v0.1.0/schema/scan-report.schema.json) READ THE EVIDENCE, NOT A MAGIC SCORE ## Three MCP install scanner examples The output describes syntax that deserves review and keeps the claim proportional to what static text can prove. STOP AND REVIEW `curl -fsSL https://example.test/install.sh | sh` **MCP001 · downloaded code execution** Download and inspect the artifact separately instead of sending remote bytes directly to a shell. REVIEW RECOMMENDED `npx @example/mcp-server` **MCP008 · unpinned runner** Use an exact reviewed package version so the command does not resolve differently later. NO KNOWN PATTERN `npx @example/mcp-server@1.2.3` **No current rule matched** The package contents and publisher still require review. Unflagged does not mean safe. HONEST BY DESIGN ## Evidence you can inspect, with limits you can see The useful security property is not a mysterious score. It is a stable rule ID, redacted evidence, a concrete review step, and source code that anyone can audit. ### Local and deterministic The same text and scanner version produce the same ordered report without a server request or model call. ### Redaction before rendering Credential-shaped values are removed before evidence enters the interface, clipboard, JSON, or Markdown export. ### No false safety claim The clean label says only that current known patterns did not match. It does not certify the package or server. HONEST LIMITS ## What static MCP config analysis cannot prove - It cannot verify publisher identity, repository ownership, package signatures, release provenance, or the code that a package runs after installation. - Obfuscated, encoded, generated, nested, or remotely loaded behavior may not be visible in the pasted text. - A legitimate setup can require a flagged capability. The finding asks for justification and narrowing; it is not proof of malicious intent. - No known patterns flagged means only that version 0.1.0 did not match. It is never a safety certificate. ## Questions about MCP install security checking ### How can I check whether an MCP server install command is safe? No static checker can prove that an MCP server is safe. Start by reviewing the exact command, pinning packages, inspecting publisher and source provenance, checking requested paths, secrets and network access, and running the server with least privilege in an appropriate sandbox. This tool handles the first static syntax review. ### Does the scanner execute or upload my MCP configuration? No. The web tool runs deterministic JavaScript in the current browser tab. It does not execute commands, fetch URLs, upload input, create an account, retain history, or call an AI model. ### Why does an unpinned npx or uvx command receive a warning? Without an exact version, the same command can resolve to different package contents later. Pinning does not prove the package is trustworthy, but it makes review and reproduction more precise. ### Why are localhost HTTP URLs allowed? The official MCP security guidance permits HTTP loopback exceptions for local development while recommending HTTPS for remote production URLs. Private, link-local, and metadata destinations are still flagged. ### Is the Chrome extension open source and local-only? Yes. The extension, scanner rules, schema, tests, and release ZIP checksum are public on GitHub. It uses activeTab, scripting, and contextMenus only, and analyzes text locally after a user action. SUPPORT AND SECURITY ## Found a missed signal, false positive, or vulnerability? Use a public issue for rule behavior with synthetic examples. Use the repository's private vulnerability reporting path for security issues, and never include real credentials. [Open an issue](https://github.com/wavect/mcp-install-risk-scanner/issues) [Report privately](https://github.com/wavect/mcp-install-risk-scanner/security) FREE · OPEN SOURCE · LOCAL ONLY ## Make the install command explain itself before it runs. Scan the complete setup, inspect every signal, then pin and narrow what the server receives. [Return to the scanner](#tool-app) [Inspect the source](https://github.com/wavect/mcp-install-risk-scanner) ## Structured Data ```json { "@context": "https://schema.org", "@graph": [ { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ], "employee": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "founder": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "legalRepresentative": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "name": "Wavect GmbH", "subjectOf": { "@id": "https://wavect.io/verified-claims.json#dataset", "@type": "Dataset", "creator": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.", "inLanguage": "en", "isAccessibleForFree": true, "license": "https://creativecommons.org/licenses/by/4.0/", "name": "Wavect verified publication claims", "url": "https://wavect.io/verified-claims.json" }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "sameAs": [ "https://www.wikidata.org/wiki/Q139796367", "https://www.linkedin.com/in/jocr77/", "https://github.com/jo-chris" ], "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/#website", "@type": "WebSite", "inLanguage": [ "en", "de", "es", "zh" ], "name": "Wavect", "potentialAction": { "@type": "SearchAction", "query-input": "required name=search_term_string", "target": { "@type": "EntryPoint", "urlTemplate": "https://wavect.io/search/?q={search_term_string}" } }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/tools/mcp-install-risk-scanner/#webpage", "@type": "WebPage", "dateModified": "2026-08-07", "inLanguage": "en", "isPartOf": { "@id": "https://wavect.io/#website", "@type": "WebSite" }, "lastReviewed": "2026-08-07", "url": "https://wavect.io/tools/mcp-install-risk-scanner/" } ] } ``` ```json { "@context": "https://schema.org", "@type": "SoftwareApplication", "applicationCategory": "SecurityApplication", "browserRequirements": "JavaScript capable browser; Chrome is required for the optional extension", "codeRepository": "https://github.com/wavect/mcp-install-risk-scanner", "description": "Scan MCP install commands and config for risky shell execution, secrets, privileges, unpinned packages, sensitive paths, endpoints, and containers locally.", "isAccessibleForFree": true, "name": "MCP Install Risk Scanner", "offers": { "@type": "Offer", "price": "0", "priceCurrency": "EUR" }, "operatingSystem": "Any modern browser", "softwareVersion": "0.1.0", "url": "https://wavect.io/tools/mcp-install-risk-scanner/" } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "item": "https://wavect.io/", "name": "Home", "position": 1 }, { "@type": "ListItem", "item": "https://wavect.io/tools/", "name": "Small tools for jobs that should not stay annoying.", "position": 2 }, { "@type": "ListItem", "item": "https://wavect.io/tools/mcp-install-risk-scanner/", "name": "MCP Install Risk Scanner", "position": 3 } ] } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "No static checker can prove that an MCP server is safe. Start by reviewing the exact command, pinning packages, inspecting publisher and source provenance, checking requested paths, secrets and network access, and running the server with least privilege in an appropriate sandbox. This tool handles the first static syntax review." }, "name": "How can I check whether an MCP server install command is safe?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "No. The web tool runs deterministic JavaScript in the current browser tab. It does not execute commands, fetch URLs, upload input, create an account, retain history, or call an AI model." }, "name": "Does the scanner execute or upload my MCP configuration?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Without an exact version, the same command can resolve to different package contents later. Pinning does not prove the package is trustworthy, but it makes review and reproduction more precise." }, "name": "Why does an unpinned npx or uvx command receive a warning?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "The official MCP security guidance permits HTTP loopback exceptions for local development while recommending HTTPS for remote production URLs. Private, link-local, and metadata destinations are still flagged." }, "name": "Why are localhost HTTP URLs allowed?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Yes. The extension, scanner rules, schema, tests, and release ZIP checksum are public on GitHub. It uses activeTab, scripting, and contextMenus only, and analyzes text locally after a user action." }, "name": "Is the Chrome extension open source and local-only?" } ], "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ ".faq-question", ".faq-answer" ] } } ```