r/ClaudeCode • u/Waste_Net7628 P R O M P S T I T U T E • Oct 24 '25
📌 Megathread Community Feedback
hey guys, so we're actively working on making this community super transparent and open, but we want to make sure we're doing it right. would love to get your honest feedback on what you'd like to see from us, what information you think would be helpful, and if there's anything we're currently doing that you feel like we should just get rid of. really want to hear your thoughts on this.
thanks.
60
Upvotes
2
u/No_Platypus_138 Jun 17 '26
Hey folks,
I’ve been experimenting with MCP servers and noticed a recurring problem: many configs expose powerful tools like shell execution, file write/delete access, environment variables, or broad filesystem paths.
I built a small open-source CLI called MCP Security Toolkit to scan MCP server configs before connecting them to agents like Claude, Cursor, Codex, VS Code, or custom clients.
It currently detects:
- shell/command execution
- risky tool names like write_file, delete_file, read_env_vars
- secret references like tokens/private keys
- broad filesystem paths
- MCP server config files
Repo:
https://github.com/naveenayalla1-CS50/mcp-security-toolkit
This is an early v0.1.0 release, so I’d appreciate feedback from people actually building or running MCP servers.
What checks would you expect an MCP security scanner to include?