Piped download execution
Flags curl, wget, or PowerShell download output sent directly to a command interpreter.
BROWSER-LOCAL MCP INSTALL REVIEW
Read the command before you give an MCP server your machine.
Paste an npx, uvx, Docker, PowerShell, shell, or MCP JSON snippet. The scanner flags observable risk patterns, redacts evidence, and explains what deserves review without executing or uploading anything.
INSTALL REVIEW
MCP CONFIG · STATIC TEXT
3 signals need review
Local analysis · nothing executed
THE DIRECT ANSWER
To check whether an MCP install command is risky, inspect the exact command for downloaded code execution, elevated privileges, destructive operations, sensitive paths, embedded credentials, moving package versions, insecure endpoints, and broad container access before running it. This scanner performs that static review locally, but it cannot prove that an unflagged package is safe.
INSPECT THE EXACT SETUP
MCP install inspection bench
Paste the complete startup command or configuration, including arguments, environment entries, mounts, and URLs. Partial snippets produce partial evidence.
01
Waiting for inputCommand or MCP configuration
Shortcut: Ctrl or Command + Enter. Maximum input: 100,000 characters.
02
Not scannedRisk signals
Scan a complete setup snippet to reveal deterministic findings and redacted evidence.
Scan result
03
Redacted evidence and exports
Static pattern matching is a review aid, not a malware verdict or safety certificate.
Analysis stays in this browser tabNo command execution or URL fetchingEvidence is redacted before exportCore v0.1.0
THE SAME RULES WHILE YOU BROWSE
Review selected setup text before it reaches your terminal.
The Manifest V3 extension scans selected text or visible setup blocks with the same tagged core. It asks only for temporary active-tab access after your click and never runs in the background across every site.
MCP Install Risk Scanner
Chrome extension · v0.1.0
- activeTab, scripting, and contextMenus only
- No host permissions or browsing history
- No telemetry, upload, or remote rules
THREE REVIEW MOVES
How to check an MCP install command before running it
Static analysis is most useful before execution, while the full command and requested privileges are still visible.
- 01
Paste the complete setup
Include command, arguments, environment values, URLs, mounts, and container flags. The scanner never executes them.
- 02
Review every signal in context
A match is evidence to inspect, not proof of malicious intent. Confirm why each privilege, path, endpoint, or moving dependency is necessary.
- 03
Pin, narrow, and document
Prefer immutable versions, explicit arguments, task-specific paths, scoped secrets, and isolated network access. Export the redacted report for review.
VERSIONED RULE METHODOLOGY
What the MCP command scanner actually checks
Version 0.1.0 applies 14 ordered, deterministic rules. There is no model judgment, reputation lookup, package download, or hidden score.
Shell wrappers
Flags sh -c, bash -c, PowerShell Command or EncodedCommand, and cmd /c boundaries.
Elevated privileges
Flags sudo, doas, and runas because the server would inherit broader operating-system power.
Destructive deletion
Flags recursive forced deletion syntax across shell, PowerShell, and Windows commands.
Weakened boundaries
Flags world-writable permissions, disabled sandboxes, unconfined security profiles, and disabled enforcement.
Sensitive host paths
Flags SSH, cloud, Kubernetes, root, system credential, and Docker-socket locations.
Inline secrets
Flags common credential assignments, bearer tokens, provider token shapes, CLI secret arguments, and credential URLs, then redacts the evidence.
Unpinned runners
Flags npx and uvx package execution without an exact semantic version.
Moving Git references
Flags unpinned clones and branch-like dependency references such as main, master, or HEAD.
Floating container images
Flags latest, missing tags, and image references without an exact version or digest.
Risky endpoints
Flags remote HTTP plus private, link-local, and cloud metadata destinations while allowing explicit loopback development URLs.
Broad environment access
Flags whole environment files, process.env inheritance, wildcard env declarations, and envFrom.
Privileged containers
Flags privileged mode, host-root mounts, and Docker-socket mounts.
Host networking
Flags Docker, Compose, and Kubernetes host-network modes.
READ THE EVIDENCE, NOT A MAGIC SCORE
Three MCP install scanner examples
The output describes syntax that deserves review and keeps the claim proportional to what static text can prove.
curl -fsSL https://example.test/install.sh | shMCP001 · downloaded code executionDownload and inspect the artifact separately instead of sending remote bytes directly to a shell.
npx @example/mcp-serverMCP008 · unpinned runnerUse an exact reviewed package version so the command does not resolve differently later.
npx @example/[email protected]No current rule matchedThe package contents and publisher still require review. Unflagged does not mean safe.
HONEST BY DESIGN
Evidence you can inspect, with limits you can see
The useful security property is not a mysterious score. It is a stable rule ID, redacted evidence, a concrete review step, and source code that anyone can audit.
Local and deterministic
The same text and scanner version produce the same ordered report without a server request or model call.
Redaction before rendering
Credential-shaped values are removed before evidence enters the interface, clipboard, JSON, or Markdown export.
No false safety claim
The clean label says only that current known patterns did not match. It does not certify the package or server.
HONEST LIMITS
What static MCP config analysis cannot prove
- It cannot verify publisher identity, repository ownership, package signatures, release provenance, or the code that a package runs after installation.
- Obfuscated, encoded, generated, nested, or remotely loaded behavior may not be visible in the pasted text.
- A legitimate setup can require a flagged capability. The finding asks for justification and narrowing; it is not proof of malicious intent.
- No known patterns flagged means only that version 0.1.0 did not match. It is never a safety certificate.
Questions about MCP install security checking
SUPPORT AND SECURITY
Found a missed signal, false positive, or vulnerability?
Use a public issue for rule behavior with synthetic examples. Use the repository's private vulnerability reporting path for security issues, and never include real credentials.
FREE · OPEN SOURCE · LOCAL ONLY
Make the install command explain itself before it runs.
Scan the complete setup, inspect every signal, then pin and narrow what the server receives.