Scan MCP and agent configs

Inventory a repo's MCP server configs and AI-agent-framework configs, and flag risky patterns in them.

sentrasec mcp-scan is not the Sentrasec MCP server — see the MCP site for that. This command runs the opposite direction: it scans other programs' MCP server configs and AI-agent-framework configs that already exist in your repo — .cursor/mcp.json, claude_desktop_config.json, agents.yaml, autogen_config.json and similar — as a security-inventory target. There is no code dependency between the two, and their tool vocabularies do not overlap.

Run it

$ sentrasec mcp-scan .

Walks the given path, skipping the usual noise directories (target, node_modules, .git, .venv, __pycache__, dist, build, tests, fixtures), and inventories two families of file:

MCP server configs — mcp.json / .mcp.json anywhere in the tree, plus .vscode/mcp.json and .cursor/mcp.json at their fixed paths. Each server entry is normalized to name, transport, command/args or URL, and the names (never values) of any env/header keys.
Agent-framework configs — LangChain, CrewAI and AutoGen config files, identified by filename plus field-name fingerprinting (a file named agent_config.json could be any of the three). Each entry is normalized to name, framework, granted tools and scope, and whether a wildcard permission marker or disabled approval gate is present.

Credential-shaped values are never captured — only key/field names. The one exception, AGENT-HARDCODED-CREDENTIALS, classifies a value only as a boolean (looks like a real secret vs. an env-var reference or placeholder) and discards the string immediately; it never appears in a finding or in JSON output.

Rules

Rule	Fires when	Severity
`MCP-SECRETS-IN-ENV`	An MCP server’s env block has a credential-shaped key name (API_KEY, TOKEN, PASSWORD, SECRET, AUTH_TOKEN, PRIVATE_KEY).	High
`MCP-UNTRUSTED-SERVER`	The server command is an unpinned package-runner invocation (npx -y <pkg> with no version, or @latest) or a bare local script path.	Critical
`MCP-UNPINNED-VERSION`	Same unpinned package-runner invocation, filed separately from MCP-UNTRUSTED-SERVER.	High
`AGENT-EXCESSIVE-TOOL-SCOPE`	A high-risk tool (name contains shell, exec, subprocess, code_interpreter, python_repl, terminal, command, bash, or eval) is granted with no scope string.	High
`AGENT-HARDCODED-CREDENTIALS`	A credential-shaped config field (api_key, openai_api_key, token, secret, …) holds a real string rather than an env-var reference or placeholder.	High
`AGENT-WILDCARD-PERMISSIONS`	The config declares an explicit "*" / "all" permission marker instead of an enumerated tool list.	Critical

Not checked: MCP server “overbroad permissions” has no implementation — it would need a live handshake with the server's declared scopes, out of static-config reach. That is a documented gap, not a silent omission.

CI gating

$ sentrasec mcp-scan . --fail-on high

Exits 3 when findings reach the given severity.

JSON output

$ sentrasec mcp-scan . --format json

Produces one envelope with mcp_configs (inventory), agent_configs (inventory) and findings — the same three-key shape sentrasec scan --format json uses for its own mcp_configs/ai_packages siblings.

Scoping the scan

sentrasec mcp-scan . --no-agent-configs           # MCP configs onlysentrasec mcp-scan . --no-mcp-configs              # agent configs onlysentrasec mcp-scan . --include-system-mcp-configs  # also check Claude Desktop’s configsentrasec mcp-scan . --format sarif                # findings only, no inventory

--include-system-mcp-configs makes the scanner walk outside the given path (macOS: ~/Library/Application Support/Claude/), so it is opt-in.

Relationship to sentrasec scan

sentrasec scan already discovers MCP configs as one rider among several (SAST + SCA + secrets + AI-package taxonomy + MCP config inventory), visible in --format json's mcp_configs array — but as inventory metadata only, not findings. sentrasec mcp-scan is the standalone surface that runs the full discover-then-judge pipeline for both config families and turns these patterns into real findings. Use scan for everything at once; use mcp-scan when MCP/agent config risk is specifically what you are triaging.