MCP Config Risk Check vs. MCP-Scan
Related tools, different layers. MCP-Scan connects to the servers in your MCP client configuration and judges their live tool descriptions for poisoning, shadowing, and rug pulls. This tool never connects to anything -- it reads the launch config itself and flags what you are about to grant a server before it ever starts.
What each tool is for
MCP-Scan (github.com/invariantlabs-ai/mcp-scan, run with
uvx mcp-scan@latest) is an open-source security scanner from Invariant Labs. Per its own
documentation, it reads your MCP client configuration to find configured servers, connects to each one,
retrieves its live tool descriptions, and scans them — combining local checks with a call to
Invariant's own Guardrailing API — for tool poisoning, prompt injection in tool descriptions,
cross-origin tool-shadowing attacks, and rug pulls (a tool's description changing after you already
approved it). Its proxy mode can also monitor live MCP traffic.
This checker reads the same kind of config file but never connects to a server at all: it
parses the command, args, and env block for each entry and flags
structural risk in the grant itself — broad filesystem or shell access, an API key or token hardcoded
in the config instead of referenced from the environment, a launched package or image with no version pin,
and a tool name that shadows another server's when a tool list is present. It runs entirely in your
browser: no install, no account, and no network call of its own.
| Question | MCP-Scan | MCP Config Risk Check |
|---|---|---|
| What it reads | Live tool descriptions, retrieved by connecting to each configured server | The launch config itself — command, args, env — nothing is run or connected to |
| Network calls | Connects to each MCP server, plus a call to Invariant's Guardrailing API | None. Everything runs client-side in your browser |
| Install | uvx mcp-scan@latest or an npx equivalent | None — a web page |
| What a finding means | A tool's description looks like poisoning, shadowing, or a post-approval rug pull | The config grants broad access, hardcodes a secret, skips a version pin, or shadows a tool name |
| When it can run | After the server is reachable and running | Before you ever launch anything — on the config text alone |
Why the launch grant is a different question from the tool description
A tool-description scan judges what a server says about itself once it is already running with whatever access the config gave it. That access is decided earlier, in the same config file MCP-Scan reads to find the server in the first place — and nothing about a clean tool-description scan tells you whether that grant was broader than the job needed, whether a token is sitting in the file in plain text, or whether the launched package is pinned to a version at all. A server can pass every tool-poisoning check and still have been launched with filesystem access it never uses, a hardcoded key that a version-controlled copy of the config would leak, or no pin on a package that could change under it on the next install.
Neither question replaces the other. A perfectly scoped, pinned, secret-free launch grant says nothing about whether the tools that server exposes are honestly described, and a clean tool-poisoning scan says nothing about whether the grant itself was tighter than it needed to be.
When to reach for MCP-Scan instead
If you want to know whether a server's tool descriptions are trying something — injected instructions, a description that silently changed since you approved it, a name that shadows another server's tool once both are connected — that is what MCP-Scan is built to answer, and it needs to actually connect to find out. This tool does not attempt that: it never reads a tool description and has no opinion on whether one is honest.
Common questions
Should I use this checker or MCP-Scan?
Different layers of the same problem. MCP-Scan (uvx mcp-scan@latest, from Invariant Labs) connects to each server named in your MCP client configuration, retrieves its live tool descriptions, and judges them for tool poisoning, prompt injection, cross-origin tool shadowing, and rug pulls -- combining local checks with a call to Invariant's own Guardrailing API. This tool never connects to anything: it reads the launch config itself and flags structural risk in what you are about to grant -- broad filesystem or shell access, an API key or token hardcoded instead of referenced from the environment, a package or image with no version pin, and a tool name that shadows another server's. If you want to know what a server's tools actually say once it is running, MCP-Scan is built for exactly that. If you want to know what your config is about to hand that server before it ever starts, this is the narrower, offline question this tool answers.
Isn't a launch config already covered by scanning the connected server?
Not the same information. A live tool-description scan sees what a server says about its tools after you have already launched it with whatever access the config granted. This checker looks at the grant itself, before that: the command, args, and env block that decide whether the server can read your filesystem, run a shell, or hold a secret in plain text in a file your client reads on every launch. A server can pass every tool-description check and still be launched with broader filesystem access, a less pinned version, or a hardcoded token than the config needed to grant.
Why would I need a config checker if MCP-Scan already exists?
Two reasons. First, what each one can see: MCP-Scan needs the server actually running and reachable, plus a call to an external API, to judge its tool descriptions; this tool needs only the config text you already have, checked entirely offline, before you decide whether to launch anything. Second, scope: this tool is not a tool-poisoning detector at all -- it never reads a tool description -- it is a structural audit of the launch grant itself, a question MCP-Scan's own documented scope does not cover.
Is this page affiliated with MCP-Scan or Invariant Labs?
No. This site is not affiliated with, endorsed by, or sponsored by Invariant Labs or the MCP-Scan project. MCP-Scan is an open-source security scanner, named here only to describe what this checker is and is not, using facts drawn from its own public documentation and source repository at github.com/invariantlabs-ai/mcp-scan.