The claim this tool leads with
A stdio MCP server's blast radius is your whole user account, not its env block.
The MCP transports specification describes stdio in one line: "The client launches the MCP server as a subprocess."
A subprocess runs with your uid. Your home directory, your SSH keys, your credential store and your network are inside
that bound whether or not a single variable is declared. So the enumerable list of secrets you hand a server is a
floor on what it can reach, never a ceiling. This page prints the account-level bound first and the secret
union second, on purpose.
Second claim, and the part that had to be rebuilt: the mutability taxonomy.
A :latest Docker tag does not re-resolve on every launch, and npx -y pkg does.
Sources for every row are in Receipts.
Accepts claude_desktop_config.json, a project .mcp.json, or any JSON with an
mcpServers or servers object. Nothing leaves this tab, and literal secret values are redacted
to a length and a short prefix in every output including the copied report.
| Server | Transport | Exec surface | Code reference | When the code is chosen | Secrets declared | Declared publisher |
|---|
This is the taxonomy the tool applies. The two rows people state backwards are the Docker tag row and the
bare-name npx row, and the npx and uvx rows are why a class keyed on "is it a
package runner" instead of "which package runner" produces confident falsehoods: they are the same shape in a config
file and resolve on opposite schedules.
| Config shape | When the code is chosen | Why |
|---|
Primary sources, quoted. Every claim above that is not arithmetic on your pasted JSON comes from one of these.