Methodology / v0.1.0
What the scanner checks.
And what it cannot prove.
A deterministic review of supported configuration settings. Every finding comes from a documented rule, not an LLM prediction.
Supported input
Cursor configurations with a top-level mcpServers object and VS Code configurations with a servers object. JSON comments and trailing commas are accepted. Duplicate keys and prototype-related property names are rejected. Limits: 1 MiB, 100 servers, 40 nesting levels and 20,000 value nodes. The browser stops a worker that exceeds its time budget.
The format selector disambiguates the supported schemas. It does not convert an arbitrary agent configuration into an MCP configuration. VS Code sandbox checks require a declared macOS or Linux target and an explicitly enabled stdio sandbox. Inherited settings and external files are not loaded.
Evidence, not a security verdict
Setting observed means the file explicitly contains the setting named in the finding. Review required means a recognizable risk pattern needs human context. Neither label establishes successful exploitation. The report replaces server names with numbered positions and never includes original values.
Scoring
For a fully supported file, start with 100 and subtract the largest penalty in each of six categories: execution, isolation, transport, supply chain, credentials and permissions. Critical: 40; high: 20; medium: 8; low: 2. Clamp the result to 0–100. Multiple findings in the same category do not multiply its penalty. Adding harmless servers cannot improve the score.
For example, one high transport finding and one critical isolation finding yield 100 − 20 − 40 = 40. This is an illustration of the formula, not a customer result. Invalid, unsupported and partially understood files receive no score. Coverage counts rule evaluations, not the percentage of your system that is secure.
Versioned rules
EX-01 / high / execution
Shell startup command needs review
A shell is asked to interpret a command string. Its effects cannot be established by this scanner.
Use an explicit executable and argument list where possible. Review the startup script and constrain its permissions.
Source guidance ↗EX-02 / critical / execution
Download-and-execute pattern
A shell command combines a downloader with execution. The downloaded program is outside this assessment.
Avoid executing mutable network content at startup. Review and pin an artifact, then run it with restricted permissions.
Source guidance ↗EX-03 / high / execution
Elevated startup command
The configured launcher requests elevated operating-system privileges.
Run the server as an unprivileged user and grant only the specific resources it needs.
Source guidance ↗IS-01 / critical / isolation
Privileged container
The Docker launcher explicitly enables privileged mode, removing important container restrictions.
Remove privileged mode. Grant individual capabilities only after reviewing why they are required.
Source guidance ↗IS-02 / high / isolation
Sensitive host mount
The Docker launcher mounts the host root, home directory or Docker socket. A read-only socket mount does not make its API read-only.
Mount only the required project directory. Do not expose the Docker socket or host root to an agent tool.
Source guidance ↗IS-03 / medium / isolation
Host namespace requested
The container requests the host network or PID namespace. Effective behavior depends on the Docker platform.
Use an isolated namespace unless a reviewed requirement makes host access necessary.
Source guidance ↗TR-01 / high / transport
Remote endpoint uses plaintext HTTP
The configured HTTP endpoint is not a literal loopback address. Transport encryption is not provided by this URL.
Use HTTPS with certificate verification. Review any private-network exception explicitly.
Source guidance ↗TR-02 / high / transport
TLS certificate verification disabled
The configuration explicitly disables certificate verification for a supported runtime or command.
Remove the bypass and configure the appropriate trusted certificate authority.
Source guidance ↗TR-03 / medium / transport
Unsupported remote URL scheme
The declared URL does not use HTTP or HTTPS. Its runtime interpretation is not supported by this scanner.
Use the transport and URL format documented by your MCP client.
Source guidance ↗SC-01 / medium / supply-chain
Runnable package is not pinned
The recognized package launcher does not select an exact package version. Future launches may execute different code.
Select a reviewed exact version. Pinning improves reproducibility but does not establish that a package is trustworthy.
Source guidance ↗CR-01 / high / credentials
Possible embedded credential
A credential-bearing field appears to contain a literal value rather than a placeholder or variable reference. The value is intentionally omitted.
Move credentials to the client's supported secret mechanism. If this original file was shared, review whether rotation is required.
Source guidance ↗PM-01 / high / permissions
Broad sandbox write scope
A supported, enabled VS Code sandbox explicitly allows writes to a broad root or home path.
Limit write access to the specific working directory required by the server.
Source guidance ↗PM-02 / medium / permissions
Unrestricted sandbox network scope
A supported, enabled VS Code sandbox explicitly allows every network domain.
Allow only the domains needed for the task. Review outbound transfer paths separately.
Source guidance ↗Unassessed controls
- This is static configuration analysis, not a penetration test or a security certification.
- Server code, tool definitions, runtime approvals, effective API permissions and actual data flows are not inspected.
- Prompt injection resistance and actual data exfiltration cannot be established from this file.
- Environment references, external files, inherited settings and operating-system controls are not resolved.
- Secret detection is heuristic. Remove credentials before selecting a file; undetected secrets may remain in the original file.
Privacy and data flow
Your configuration is read in browser memory and analyzed by a local worker. It is not uploaded, persisted in local storage, sent to an LLM or attached to a consultation request. Clearing the report releases the page's references; this is not a guarantee of secure memory erasure by the browser.
No advertising tags, session replay, third-party fonts or visitor identifiers are loaded by this scanner. If you opt in, usage events contain only an event name and the scanner version: view, scan_started, scan_completed, scan_incomplete or report_downloaded. Example scans are excluded. There is no retrospective upload of past events. Disabling the option prevents future events; it cannot retract an event already sent.
The separate assessment form sends only the fields you submit, after contact consent. Hosting and request providers can process normal connection metadata such as IP addresses. Counts are opt-in and can include repeated visits; they are not a count of unique people. Company privacy policy.
Report an incorrect result
Email partner@salem-ai.com with the rule ID, expected behavior and a minimal sanitized example. Do not send production secrets. We review rule changes against positive and negative fixtures.
Open scanner ↗