{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreiewvjqqekumllfdvz5b47ohxcj6v5jcawx4fecpi4ouxdvxpvyr4m",
    "uri": "at://did:plc:25rdn5elo5izoxrmtis34zuk/app.bsky.feed.post/3mpcugfpyz3m2"
  },
  "coverImage": {
    "$type": "blob",
    "ref": {
      "$link": "bafkreihulvdpgb2v2nnjscqybqwlisozzjlsc4vep55z5qrtfnvx2bxbke"
    },
    "mimeType": "image/webp",
    "size": 74864
  },
  "path": "/alih552/i-scanned-my-mcp-setup-and-it-scored-0100-heres-what-was-wrong-28g",
  "publishedAt": "2026-06-28T01:40:10.000Z",
  "site": "https://dev.to",
  "tags": [
    "mcp",
    "ai",
    "security",
    "claude",
    "https://github.com/alih552/mcp-audit",
    "https://alih552.github.io/mcp-forge/checklist.html",
    "https://alih552.github.io/mcp-forge/"
  ],
  "textContent": "I've been adding MCP servers to Claude and Cursor for months — GitHub, a filesystem server, a couple of search servers, a little internal HTTP one I wrote. It works great. Then two things bugged me:\n\n  1. Some of those servers have **no authentication at all**. Anyone who can reach the URL can call my tools.\n  2. My context window felt _full_ before I even typed a prompt.\n\n\n\nTurns out it's not just me. A 2026 analysis of ~7,000 public MCP servers found **41% require no auth** , **36.7% are SSRF-vulnerable** , and only **8.5% use OAuth**. So I wrote a tiny tool to check my own config — and it scored **0 out of 100**.\n\n##  The tool\n\n`mcp-audit` (https://github.com/alih552/mcp-audit) is a zero-dependency CLI that reads your MCP config (Claude Desktop, Cursor, VS Code, Windsurf, or a plain .mcp.json) and tells you what's wrong. It runs **100% locally** — it never connects to your servers or sends your config anywhere.\n\n\n    pipx install git+https://github.com/alih552/mcp-audit\n    mcp-audit\n\n\nHere's the kind of thing it flagged on my (deliberately messy) test config:\n\n\n    MCP Audit — ~/.cursor/mcp.json\n      7 server(s) - ~13,160 context tokens - score 0/100 (F)\n\n    [HIGH] Remote server with no authentication  (internal-api)\n    [HIGH] Plaintext secret in config (GitHub token)  (github)\n    [MED]  Unpinned auto-updating executable (npx -y)  (filesystem)\n    [MED]  Over-broad filesystem root '/Users'  (filesystem)\n    [LOW]  7 servers ~ 13,160 context tokens loaded every request\n\n\n##  What each finding actually means\n\n**No auth on a remote server.** If your MCP server is reachable over HTTP and doesn't check a token, the model — or anyone who finds the URL — can run your tools. With prompt injection in the wild, the _server_ has to hold the line, not the model.\n\n**Plaintext secrets in the config.** A GITHUB_TOKEN sitting in .mcp.json leaks through the file itself and through your git history. Move it to an env var or a secret manager.\n\n**npx -y / uvx without a pinned version.** That silently runs whatever was published most recently. It's a supply-chain risk — pin the version and review updates.\n\n**Over-broad filesystem roots.** A filesystem server pointed at /Users or $HOME lets the model read and write far more than your project. Scope it to the project directory.\n\n**Token bloat.** This was the one I didn't expect. Every server loads its tool schemas into _every_ request. Five servers commonly cost **50-75k tokens of context before you type a word** — that's real money and real latency. Disable the servers you aren't actively using.\n\n##  The fix\n\nFor the config issues: pin versions, move secrets to env vars, scope filesystem access, and put auth in front of anything remote. There's a full MCP Server Security Checklist here: https://alih552.github.io/mcp-forge/checklist.html\n\nIf you're _building_ an MCP server and want it secure from commit one, I also put together MCP Forge Kit (https://alih552.github.io/mcp-forge/) — a secure-by-default starter (bearer + JWT auth, SSRF-safe fetch, rate limiting, validation, tests, CI). But the auditor above is free and MIT, and genuinely useful on its own.\n\n##  Try it on your setup\n\n\n    pipx install git+https://github.com/alih552/mcp-audit\n    mcp-audit --json\n\n\nI'd love feedback on the checks — especially **false positives** and checks you think are missing. Repo: https://github.com/alih552/mcp-audit",
  "title": "I scanned my MCP setup and it scored 0/100. Here's what was wrong."
}