Free tool · #4
AI Tool Permissions Audit
MCP servers are the plug-ins that let AI apps like Claude, Cursor and VS Code read your files, run commands and log in to services. Paste your config and we'll tell you, server by server, what each one can touch and what to tighten.
Nothing leaves your browser
The check runs on this page, in your browser. Your config is never uploaded, stored or logged. Open your browser's network tab and watch: nothing is sent.
Where is my config?
Claude Desktop: Settings → Developer → Edit Config. Claude Code: .mcp.json in your project. Cursor: ~/.cursor/mcp.json. VS Code: .vscode/mcp.json.
What we flag
API keys pasted in plain text, packages that auto-update to whatever is published next, access to your whole disk or shell, auto-approve settings, and servers that can touch code, money, mail or databases.
Found a key?
Treat it as exposed: make a new one, delete the old one, and keep the new one in your system keychain or an environment variable instead of the file.