Most developers running MCP servers locally or in CI have no idea what's in their config files. Hardcoded API keys, missing auth, tools with wildcard permissions — it's the early days of Docker Hub all over again.

MCPSec scans MCP server configs (Claude Desktop, Cursor, VS Code, DXT extensions) for the OWASP MCP Top 10 risks. Written in Go, outputs OCSF JSON, has a pluggable YAML rules engine for community detections.