MCP servers expose tools to LLMs, but most configs grant tools broader permissions than they need, ship without auth, and leak prompt-injection surface in tool descriptions. This scanner finds it before your model does.
Most MCP servers I've audited in the last few months had the same three issues:
A shell or fs tool was scoped to the entire filesystem when the use case needed exactly one directory.
The transport ran without auth because the local-dev SSE config got promoted to prod.
Tool descriptions echoed verbatim into prompts with no sanitization — a perfect injection surface.
