Documentation

How ShieldMCP works

ShieldMCP scans your Model Context Protocol (MCP) configuration against the OWASP MCP Top 10 — the category framework used to organize findings. Below are the patterns checked, their limits, and suggested manual review steps.

Quick start

1Find your MCP config file (see locations below).
2Use a sanitized copy under 50 KB; replace credentials with placeholders, then upload or paste JSON.
3Get a static configuration score and category flags — free, no account.
4Unlock the full report ($49 one-time) for remediation guidance, available examples, and a shareable PDF.

Where is my config file?

Claude Desktop (macOS)~/Library/Application Support/Claude/claude_desktop_config.json

Claude Desktop (Windows)%APPDATA%\Claude\claude_desktop_config.json

Cursor.cursor/mcp.json (in your project) or ~/.cursor/mcp.json

Windsurf~/.codeium/windsurf/mcp_config.json

VS Code (Continue / others).vscode/mcp.json or your extension config

Your config is sent to our server for analysis. Use a sanitized copy; secret detection and redaction are not guarantees that every sensitive value will be found. Results are retained for seven days from scanning or starting checkout. Anyone with a scan URL can access its results, including the full report after payment. Keep the link private. Read the privacy and retention notice.

The OWASP MCP Top 10

Static rules are mapped to the ten categories below. A score is not proof of safety: no flags means no rule matched. Runtime behavior, tool definitions, reachability, and effective permissions are not verified.

MCP01

Token Mismanagement & Secret Exposure

What it is: Credential-like patterns in configuration fields.
Why it matters: A credential included in a shared config may be exposed to recipients. A pattern match does not establish that a value is an active secret.
What ShieldMCP checks: Checks selected environment names and values for credential-related names, token prefixes, authorization patterns, and character-pattern heuristics.
How to fix: Review flagged values locally. Use the server-supported secret mechanism for active credentials and rotate credentials that have been exposed.

MCP02

Privilege Escalation via Scope Creep

What it is: Configuration hints of broad filesystem, database, or payment access.
Why it matters: Broad paths and credential patterns warrant review, but effective permissions depend on the server, operating system, and provider.
What ShieldMCP checks: Looks for root or home paths, wildcards, database tooling without recognized read-only hints, and payment-key patterns. Actual access and credential scopes are not tested.
How to fix: Limit paths and operations to task requirements. Verify operating-system permissions, database grants, and provider scopes rather than relying on configuration hints alone.

MCP03

Tool Poisoning

What it is: Package-source and instruction-like patterns that warrant review.
Why it matters: Local sources, unusual package names, or directive-like text can be legitimate. These patterns do not establish malicious intent or runtime tool poisoning.
What ShieldMCP checks: Looks for local package references, package-name heuristics, invisible characters, and directive-like markers in checked config fields. Installed source and tool responses are not inspected.
How to fix: Review the original fields and package source locally. Confirm the intended publisher, version local source, restrict write access, and investigate unexpected configuration changes.

MCP04

Software Supply Chain Attacks & Dependency Tampering

What it is: Package references that need version and provenance review.
Why it matters: A reference alone does not establish installed contents, integrity controls, registry ownership, or whether an advisory applies at runtime.
What ShieldMCP checks: Checks for missing exact version pins, Git or local sources, prerelease references, namespace heuristics, and matches against a curated package-advisory catalog.
How to fix: Pin an approved version or reviewed immutable revision. Verify provenance, registry resolution, installed contents, and applicable advisories through your dependency review process.

MCP05

Command Injection & Execution

What it is: Shell, inline-code, and argument patterns in server definitions.
Why it matters: A shell or metacharacter can be intentional or literal data. Exploitability depends on argument handling, input sources, and runtime isolation.
What ShieldMCP checks: Matches shell executables, inline execution flags, shell metacharacters, eval or exec text, and potentially shared temporary paths. It does not execute commands or test file permissions.
How to fix: Review argument handling locally. Prefer structured arguments, avoid turning untrusted values into code, and verify permissions and isolation for the intended server.

MCP06

Intent Flow Subversion

What it is: Names or arguments that suggest external content ingestion.
Why it matters: External content may contain instructions. The scan does not inspect retrieved content, model behavior, or runtime defenses.
What ShieldMCP checks: Matches configuration hints associated with retrieval, browsing, search, messaging, and remote content sources. Actual tool responses are not tested.
How to fix: Separate external content handling from privileged actions where practical. Enforce permissions and approval checks outside the model before sensitive actions.

MCP07

Insufficient Authentication & Authorization

What it is: Transport, bind-address, and credential-setting patterns.
Why it matters: A missing recognized credential setting does not prove missing authentication. Headers, proxies, keychains, or other mechanisms may supply it.
What ShieldMCP checks: Checks URL schemes, bind-address patterns, missing recognized credential variables, and weak or placeholder-like values. Reachability, TLS behavior, and effective authentication are not tested.
How to fix: Verify the active authentication mechanism and granted permissions. Use validated TLS for sensitive network traffic and review bind addresses, network controls, and supported secret handling.

MCP08

Lack of Audit and Telemetry

What it is: Missing logging settings recognized by the static check.
Why it matters: Logging may exist outside this config. The scan cannot establish whether audit trails are absent, useful, or sufficient for a compliance requirement.
What ShieldMCP checks: Looks for recognized logging settings and possible write-capability hints. Runtime logs, provider audit trails, and actual write permissions are not inspected.
How to fix: Consult server documentation and review existing audit trails. Enable supported logging for sensitive operations, omit credentials and sensitive payloads, and verify events reach protected storage.

MCP09

Shadow MCP Servers

What it is: Duplicate references and endpoint or naming patterns for inventory review.
Why it matters: An unfamiliar name, port, or endpoint does not establish a hidden server, active listener, or malicious process.
What ShieldMCP checks: Looks for duplicate package references, URL patterns, ports outside the scanner common-port list, and generic server names. It does not discover running servers.
How to fix: Confirm intended endpoints and document their purpose. Review duplicates before removing them, and check locally which processes and services are actually in use.

MCP10

Context Injection & Over-sharing

What it is: Configuration hints of sensitive data sources alongside outbound tools.
Why it matters: These combinations suggest possible data flows, not verified access, transmission, or exfiltration. Runtime permissions and destination controls may restrict them.
What ShieldMCP checks: Matches names and arguments associated with filesystem, database, personal or financial data, and outbound communication. It does not read records or send data.
How to fix: Keep only sources required for the task. Separate capabilities where practical; otherwise restrict paths, records, and destinations and require authorization for sensitive transfers.

How scoring works

Every scan starts at 100 and deducts points per issue found, capped per severity so one category can never sink the entire score:

Critical−20 eachmax −60

High−10 eachmax −30

Medium−5 eachmax −15

Low−2 eachmax −6

80–100

Low Risk

60–79

Medium Risk

40–59

High Risk

0–39

Critical Risk

Ready to check your setup?

Run a free configuration scan — no account required.

Run Free Scan