MCP Server Privilege Inventory

Paste an MCP client config. Get the exec surface, the code-reference mutability, and the secrets, computed in this tab.

The claim this tool leads with

A stdio MCP server's blast radius is your whole user account, not its env block. The MCP transports specification describes stdio in one line: "The client launches the MCP server as a subprocess." A subprocess runs with your uid. Your home directory, your SSH keys, your credential store and your network are inside that bound whether or not a single variable is declared. So the enumerable list of secrets you hand a server is a floor on what it can reach, never a ceiling. This page prints the account-level bound first and the secret union second, on purpose.

Second claim, and the part that had to be rebuilt: the mutability taxonomy. A :latest Docker tag does not re-resolve on every launch, and npx -y pkg does. Sources for every row are in Receipts.

Paste a config

Accepts claude_desktop_config.json, a project .mcp.json, or any JSON with an mcpServers or servers object. Nothing leaves this tab, and literal secret values are redacted to a length and a short prefix in every output including the copied report.

How the mutability classes are assigned

This is the taxonomy the tool applies. The two rows people state backwards are the Docker tag row and the bare-name npx row, and the npx and uvx rows are why a class keyed on "is it a package runner" instead of "which package runner" produces confident falsehoods: they are the same shape in a config file and resolve on opposite schedules.

Config shape When the code is chosen Why

Receipts

Primary sources, quoted. Every claim above that is not arithmetic on your pasted JSON comes from one of these.

What this tool refuses to do

Related tools