See your agent's blast radius.

Paste your mcp.json and see what the file proves: which servers hold a credential, which fetch their code fresh at every launch, and which can reach off your machine. Paste a tools/listdump and it goes per tool - which calls can't be undone, which send data off your machine, and how many contracts are unpinned, with nothing watching them for change.

That last one is not hypothetical. Across the public MCP servers we re-crawl daily, 6,685 tools have changed a safety-relevant field. Not confirmed vulnerabilities, but the changes a pin exists to catch. 8,486 of 11,750 drifting tools have only ever changed with their declared version unchanged, where version evidence exists, so a version pin does not see them. Check the numbers yourself →

It runs entirely in your browser. Your config is read locally and never uploaded - which matters, because that file holds your tokens.

/scanruns in your browser · nothing uploaded

paste from clipboardchoose a fileor drop your mcp.json anywhere in this panelor open it with “choose a file”

your config

Where's my file?

Claude DesktopCursorVS CodeClineWindsurf

macwinlinux

~/Library/Application Support/Claude/claude_desktop_config.json

copy reveal command

paths vary by version; open the file and drop or paste it above

no config handy?sample configsample tools

nothing to scan yet · add your mcp.json above

scan my setup

sample setup - not your config

a realistic toolset, so the page is never empty

10

tools your agent can call

3

can't be undone

1

send data off-machine

10

unpinned contracts

unpinned = not yet watched for drift. a fresh scan pins nothing, so this equals your tool count until the gate is installed - it is a state, not a finding.

10 unpinned contracts.This is Monday's picture. Any of these tools can change what it declares between runs, with nothing in your repo to diff. mcpindex pins each contract and HOLDs the call when it drifts.

copy install ↗see a HOLD →

deterministic contract-diff, not a safety verdict · fails open · advisory

tool	action	effect	reversibility	egress
read_file	read	read-only	reversible	·
list_directory	list	read-only	reversible	·
search_docs	search	read-only	reversible	·
postgres_query	search	writes locally	reversible	internal
write_file	write	writes locally	hard to reverse	internal
update_recordannotation says read-only; schema exposes write/delete parameters	update	writes locally	hard to reverse	internal
slack_send_message	send	sends outbound	hard to reverse	off-machine
delete_filedestructive with no obvious undo path	delete	destructive	irreversible	internal
stripe_create_chargedestructive with no obvious undo path	write	destructive	irreversible	internal
run_commanddestructive with no obvious undo path	execute	destructive	irreversible	internal

share these numbers

copy card image link

counts only - no tool names or schemas are in the link

  to your agent, both of these are just "a tool call":

    search_docs(query)                      delete_repo(name)
          |                                       |
   ACTION | read                           delete |
  TOUCHES | documents                      a repo |
  REVERSE | n/a                     not reversible|
   EGRESS | stays local                stays local|
          v                                       v
   CEILING  autonomous                    ask a human

  deterministic and static, read from the tool's own declared contract.
  it does not run the tool. ambiguous contracts grade toward the more
  dangerous class, never down. advisory: mcpindex labels the blast radius,
  your agent or IDE decides.