{
 "schema_version": 1,
 "generated": "2026-10-20",
 "id": "graygnatconsole-mcp-audit-tool--audit-local-mcp-configs-for-secrets",
 "repo": "graygnatconsole/mcp-audit-tool",
 "repo_url": "https://github.com/graygnatconsole/mcp-audit-tool",
 "repo_slug": "graygnatconsole-mcp-audit-tool",
 "title": "Find leaked keys and risky MCP servers on your machine",
 "page_title": "How to find leaked keys and risky MCP servers on your machine with MCP Audit Tool",
 "summary": "Scan every MCP config on a workstation and get a graded list of secrets and risky launch commands.",
 "who": "A developer who has added several MCP servers to Claude Desktop, Cursor, or VS Code and wants to know what those configs expose before the model runs them.",
 "problem": "A single line in an MCP config can hold an API key in plaintext, fetch an unpinned package on every launch, or run a pipe-to-shell installer, and these are easy to miss by reading JSON by hand.",
 "outcome": "A terminal report with a security score, a grade from A+ to F, each finding tied to a rule ID, and the top remediation steps to fix first.",
 "steps": [
  "Install the tool with `pipx install git+https://github.com/graygnatconsole/mcp-audit-tool.git`.",
  "Run `mcp-audit scan` to auto-discover and audit every MCP config on this machine.",
  "Read the findings table and note every CRITICAL and HIGH row, starting with MAT-001 (hardcoded secrets) and MAT-004 (pipe-to-shell installers).",
  "Move each exposed credential to a secrets manager and rotate it, then pin any unpinned npx, uvx, or pipx package to a known version.",
  "Run `mcp-audit scan` again and confirm the score improved."
 ],
 "agent_prompt": "Use the GitHub repo graygnatconsole/mcp-audit-tool to run `mcp-audit scan <config-path>` on the MCP config at <config-path>. Return the score, grade, and a list of CRITICAL and HIGH findings with their rule IDs. Verify that the report lists each server name from the config file.",
 "agents": [
  "any"
 ],
 "difficulty": "Intermediate",
 "time": "15 minutes",
 "basis": "readme",
 "caveat": "This is a static analyzer of config files, so it does not probe live servers, and the README roadmap lists runtime tool checks and auto-fix as planned, not built.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "python",
 "requirements": [
  "Python 3.9 or newer",
  "pipx or pip available in the terminal",
  "An MCP client config file (for example claude_desktop_config.json or .cursor/mcp.json), or access to the machine where those files live"
 ],
 "risk": "sensitive",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "credentials",
   "notice": "The configs being scanned often contain live API keys, so rotate any credential the report flags and avoid pasting raw config contents into shared chats or tickets."
  }
 ],
 "best": true,
 "score": 1.0,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/graygnatconsole-mcp-audit-tool/audit-local-mcp-configs-for-secrets/",
 "md": "https://dedupedai.com/use-cases/graygnatconsole-mcp-audit-tool/audit-local-mcp-configs-for-secrets/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/graygnatconsole-mcp-audit-tool--audit-local-mcp-configs-for-secrets.json",
 "api_version": "v1"
}