Inspect MCP server configuration permissions and access scope #26

Feature proposal — review before implementation

Track this independently so the owner can review behavior, example output, and scoring before selecting it for implementation. This issue does not authorize implementation or deployment; scoring below is provisional.

MCP servers execute software and inherit available access. Scan known local MCP configurations for excessive scope and tampering exposure, without treating MCP itself as a vulnerability.

Proposed checks

• Define supported clients and config paths explicitly.
• Identify whole-home/sensitive-directory filesystem grants and known unrestricted shell-server configurations.
• Check whether other users can modify the executable server configuration, or read credential-bearing configuration.
• Parse configuration only; do not launch a configured server to inspect it. Redact secret values.

Example output and proposed scoring

WARMING UP (+4): MCP filesystem server is configured with access to your entire home directory.
COOKED (+10): MCP server launch configuration is writable by other users.

Broad scope can be intentional. Group permissions, parent-directory access, ACLs, and unsupported config formats need explicit treatment; absence of recognized configuration is not proof of safety.

Acceptance criteria

• Cover restricted/broad grants, writable/protected configurations, malformed files, and unsupported clients.
• Report evidence and a practical narrowing/permissions recommendation.
• Avoid double-counting existing sensitive-file checks.

Reference: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/SECURITY.md

Review gate

• Review supported scope and false-positive handling.
• Approve example output and scoring.
• Select for implementation, then add focused regression tests.