The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the MCP Customs listing page.
Inspect an MCP server for common security risks before you install it. Runs fully offline. No telemetry, no cloud upload, no account.
Developers install MCP servers the way they used to install npm packages — quickly, trusting the name, and moving on. An MCP server can read your files, call your APIs, and execute commands on your behalf. Almost nobody checks what it can actually do before connecting it to their agent.
mcp-customs is the "audit before install" step, run locally, in seconds.
| Rule | Severity | What it looks for |
|---|---|---|
| MCP001 | critical | Shell command execution with unsanitized interpolation |
| MCP002 | high | File reads/writes without a path-traversal guard |
| MCP003 | critical | eval() / dynamic code execution |
| MCP004 | high | Hardcoded API keys / credentials |
| MCP005 | critical | Tool descriptions containing hidden-instruction language (prompt injection via the tool's own metadata) |
| MCP006 | medium | Outbound network calls combined with environment-variable reads (possible exfiltration) |
| MCP007 | low | No permissions/scopes declared in the manifest |
These are heuristic, regex-based checks — fast and fully auditable in one sitting, not a dataflow analysis. They will produce false positives and will miss things a deeper analysis would catch. Treat a CLEARED stamp as "nothing obvious," not "verified safe."
Apache-2.0. No open-core trap — this CLI stays free either way. If a hosted registry/dashboard ships later, that's a separate paid product; this tool's local scanning will never require it.