Docs

Scan from the terminal

npx mcpvetter scan                  # discover configs + static scan
npx mcpvetter scan --live           # also start and inspect servers (asks first, per server)
npx mcpvetter scan --json out.json  # machine-readable report
npx mcpvetter scan --fail-on high   # exit 1 if any finding is high or worse (CI)
npx mcpvetter list                  # inventory only
npx mcpvetter explain MCP-SECRET-001

Exit codes: 0 no findings at or above the threshold, 1 findings at or above it, 2 the scan could not complete.

Add it to your AI client (local, recommended)

The local server runs every check on your machine. Without a key you get the free scanner tools; add an API key from your account to unlock Pro tools.

Claude Code

Cursor (~/.cursor/mcp.json)

{
  "mcpServers": {
    "mcpvetter": {
      "command": "npx",
      "args": [
        "-y",
        "mcpvetter",
        "serve"
      ],
      "env": {
        "MCPVETTER_API_KEY": "mcpv_live_YOUR_KEY"
      }
    }
  }
}

VS Code (.vscode/mcp.json)

{
  "servers": {
    "mcpvetter": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "mcpvetter",
        "serve"
      ],
      "env": {
        "MCPVETTER_API_KEY": "mcpv_live_YOUR_KEY"
      }
    }
  }
}

Remote endpoint (claude.ai, ChatGPT, any client that cannot run local servers)

Streamable HTTP with OAuth: your client opens a sign-in page the first time. Clients that support headers can send Authorization: Bearer mcpv_live_YOUR_KEY instead. Code sent to the remote endpoint is analysed in memory and not stored.

Example prompts

• "audit my MCP setup"
• "check this code for vulnerabilities"
• "show me the secure version of this pattern"
• "start lab lab-01-secrets"

Tools

Tool	Plan	What it does
check_mcp_setup	Free	MCP posture summary with fixes
explain_finding	Free	Plain-English explanation of a finding ID
review_code	Pro (5/day free)	Findings for a snippet, each linked to a pattern and lab
secure_pattern	Pro (2 free)	Secure example in your stack, anti-pattern, reviewer checklist
start_lab / check_lab	Pro (2 free)	5-minute lab and automatic verification
team_posture	Team	Aggregated counts for your team