DEV Community: Ali Al-Jaafari

I built a free browser tool that scores your MCP setup for security

Ali Al-Jaafari — Mon, 29 Jun 2026 16:03:57 +0000

Recently I scanned my own MCP config and it scored 0 out of 100. I wrote a small CLI for that. The problem with a CLI is friction: most people will not install something just to check.

So I rebuilt the same checks to run entirely in the browser. Paste your config, get a score and a list of fixes, and nothing leaves your machine.

Try it (no install, no signup): https://alih552.github.io/mcp-forge/scan.html

What it flags

The scanner reads a Claude Desktop, Cursor, or plain .mcp.json config and checks for:

remote servers with no authentication
cleartext http endpoints
secrets pasted in plaintext (it knows the common token shapes)
unpinned npx and uvx runners that fetch the newest package every launch
over-broad filesystem roots like / or your home folder
TLS verification turned off (NODE_TLS_REJECT_UNAUTHORIZED=0 and friends)
servers bound to 0.0.0.0
and it estimates how many context tokens your servers cost on every request

Each finding comes with the exact fix, and you get a score out of 100 grouped by risk class.

Why it runs client-side

A config can contain real secrets, so uploading it to a scanner would be its own security problem. The whole thing runs in JavaScript in your tab. The same checks are in the open source CLI if you prefer to run it locally or in CI: pipx install git+https://github.com/alih552/mcp-audit.

I would love to hear what score people get, and which checks you would add. What does your config say?

Your MCP servers are burning 50k+ tokens before you type a word

Ali Al-Jaafari — Sun, 28 Jun 2026 19:41:42 +0000

Here is something I did not realize about the Model Context Protocol until my context window kept feeling full for no reason.

Every MCP server you connect loads its full set of tool definitions into the context window on every single request. Those schemas are not free. Each tool costs a few hundred tokens, and they are sent before the model reads a word of your prompt.

Five typical servers, with a dozen or more tools each, commonly add up to 50,000 to 75,000 tokens of overhead per request. That is real money on every call, and latency you feel on every turn. It also crowds out the context you actually want the model to use.

Measure it first

You cannot cut what you cannot see. A rough rule is about 200 tokens per tool plus a small per-server overhead. I built a tiny tool that prints an estimate for your real config (and checks security while it is at it):

pipx install git+https://github.com/alih552/mcp-audit
mcp-audit
# -> 7 server(s) - ~13,160 context tokens - score 0/100

It runs fully locally, zero dependencies, MIT.

Then cut it

Turn off what you are not using. The biggest lever and the easiest. Most people leave servers connected that they touched once. Going from seven always-on servers to the two you actually use can reclaim tens of thousands of tokens.
Remove redundant servers. Two search servers, two file servers. Pick one per capability.
Trim tool surface on servers you build. Ten focused tools beat thirty overlapping ones, both for token cost and for the model picking the right one. Keep descriptions tight.
Load niche servers on demand rather than keeping everything always on.

The default of "everything connected all the time" is what creates the bloat. A few minutes of cleanup pays for itself on every request after.

Repo and the full writeup: https://github.com/alih552/mcp-audit

Curious what context-token number people get on their setups.

I scanned my MCP setup and it scored 0/100. Here's what was wrong.

Ali Al-Jaafari — Sun, 28 Jun 2026 01:40:10 +0000

I've been adding MCP servers to Claude and Cursor for months — GitHub, a filesystem server, a couple of search servers, a little internal HTTP one I wrote. It works great. Then two things bugged me:

Some of those servers have no authentication at all. Anyone who can reach the URL can call my tools.
My context window felt full before I even typed a prompt.

Turns out it's not just me. A 2026 analysis of ~7,000 public MCP servers found 41% require no auth, 36.7% are SSRF-vulnerable, and only 8.5% use OAuth. So I wrote a tiny tool to check my own config — and it scored 0 out of 100.

The tool

mcp-audit (https://github.com/alih552/mcp-audit) is a zero-dependency CLI that reads your MCP config (Claude Desktop, Cursor, VS Code, Windsurf, or a plain .mcp.json) and tells you what's wrong. It runs 100% locally — it never connects to your servers or sends your config anywhere.

pipx install git+https://github.com/alih552/mcp-audit
mcp-audit

Here's the kind of thing it flagged on my (deliberately messy) test config:

MCP Audit — ~/.cursor/mcp.json
  7 server(s) - ~13,160 context tokens - score 0/100 (F)

[HIGH] Remote server with no authentication  (internal-api)
[HIGH] Plaintext secret in config (GitHub token)  (github)
[MED]  Unpinned auto-updating executable (npx -y)  (filesystem)
[MED]  Over-broad filesystem root '/Users'  (filesystem)
[LOW]  7 servers ~ 13,160 context tokens loaded every request

What each finding actually means

No auth on a remote server. If your MCP server is reachable over HTTP and doesn't check a token, the model — or anyone who finds the URL — can run your tools. With prompt injection in the wild, the server has to hold the line, not the model.

Plaintext secrets in the config. A GITHUB_TOKEN sitting in .mcp.json leaks through the file itself and through your git history. Move it to an env var or a secret manager.

npx -y / uvx without a pinned version. That silently runs whatever was published most recently. It's a supply-chain risk — pin the version and review updates.

Over-broad filesystem roots. A filesystem server pointed at /Users or $HOME lets the model read and write far more than your project. Scope it to the project directory.

Token bloat. This was the one I didn't expect. Every server loads its tool schemas into every request. Five servers commonly cost 50-75k tokens of context before you type a word — that's real money and real latency. Disable the servers you aren't actively using.

The fix

For the config issues: pin versions, move secrets to env vars, scope filesystem access, and put auth in front of anything remote. There's a full MCP Server Security Checklist here: https://alih552.github.io/mcp-forge/checklist.html

If you're building an MCP server and want it secure from commit one, I also put together MCP Forge Kit (https://alih552.github.io/mcp-forge/) — a secure-by-default starter (bearer + JWT auth, SSRF-safe fetch, rate limiting, validation, tests, CI). But the auditor above is free and MIT, and genuinely useful on its own.

Try it on your setup

pipx install git+https://github.com/alih552/mcp-audit
mcp-audit --json

I'd love feedback on the checks — especially false positives and checks you think are missing. Repo: https://github.com/alih552/mcp-audit