{
  "markdown": "<!-- mcp-name: io.github.mcpcustoms/mcp-customs -->\n\n# mcp-customs\n\nInspect an MCP server for common security risks **before** you install it.\nRuns fully offline. No telemetry, no cloud upload, no account.\n\n```\nnpx mcp-customs scan ./some-mcp-server\n```\n\n```\n──────────────────────────────────────────────────────\nMCP-CUSTOMS INSPECTION REPORT\n──────────────────────────────────────────────────────\ntarget        ./some-mcp-server\nfiles scanned 14\nscore         62 / 100\nstamp         [ REVIEW ]\n──────────────────────────────────────────────────────\n[HIGH] MCP002 — Unsanitized file path (possible path traversal)\n  server.js:41  return fs.readFileSync(userPath, 'utf8');\n  fix: Resolve the path against an allowed base directory ...\n```\n\n## Why\n\nDevelopers install MCP servers the way they used to install npm packages —\nquickly, trusting the name, and moving on. An MCP server can read your\nfiles, call your APIs, and execute commands on your behalf. Almost nobody\nchecks what it can actually do before connecting it to their agent.\n\n`mcp-customs` is the \"audit before install\" step, run locally, in seconds.\n\n## What it checks (v0.1)\n\n| Rule   | Severity | What it looks for |\n|--------|----------|--------------------|\n| MCP001 | critical | Shell command execution with unsanitized interpolation |\n| MCP002 | high     | File reads/writes without a path-traversal guard |\n| MCP003 | critical | `eval()` / dynamic code execution |\n| MCP004 | high     | Hardcoded API keys / credentials |\n| MCP005 | critical | Tool descriptions containing hidden-instruction language (prompt injection via the tool's own metadata) |\n| MCP006 | medium   | Outbound network calls combined with environment-variable reads (possible exfiltration) |\n| MCP007 | low      | No permissions/scopes declared in the manifest |\n\nThese are heuristic, regex-based checks — fast and fully auditable in one\nsitting, not a dataflow analysis. They will produce false positives and\nwill miss things a deeper analysis would catch. Treat a CLEARED stamp as\n\"nothing obvious,\" not \"verified safe.\"\n\n## CI usage\n\n```yaml\n# .github/workflows/mcp-customs.yml\n- run: npx mcp-customs scan . --sarif results.sarif --fail-on high\n- uses: github/codeql-action/upload-sarif@v3\n  with:\n    sarif_file: results.sarif\n```\n\n## Get a badge for your README\n\n```\nnpx mcp-customs scan . --badge --name your-server-name\n```\n\n## Roadmap\n\n- [ ] Publish scan results to a public registry (mcp-customs.dev) with searchable trust scores\n- [ ] Dynamic/sandboxed analysis (catch what static checks miss)\n- [ ] Python-specific AST checks (current Python rules are regex-only)\n- [ ] Community flagging / verification on registry entries\n\n## License\n\nApache-2.0. No open-core trap — this CLI stays free either way. If a\nhosted registry/dashboard ships later, that's a separate paid product;\nthis tool's local scanning will never require it.\n",
  "bytes": 2877,
  "sha": "0b91c3120ce483d740dbdc781e45dd7392cc5f45c749e003bf4ebfe03e37daf6",
  "repo_slug": "mcpcustoms/mcp-customs",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_mcpcustoms_mcp_customs_567f4d34/readme"
}