Check your MCP config.
Paste an MCP configuration or a tool list. The check finds paths where untrusted text could send private data out. It groups them by exit and writes starter Cedar policies.
Your agent’s exits
Static check of a configuration
Not checked yet
Try an example
MCP JSON from Claude, Cursor, VS Code or Zed, a tools/list result, or one tool name per line.
Paste a configuration or a tool list, or try an example.
Nothing leaves this page. It runs in your browser, and offline too: nothing you paste is sent, stored or logged, and keys are never shown.
What this check can’t see
It reads a configuration. It doesn’t run your agent, so it can’t prove a path is exploitable, or that one is closed.
- Tools added at runtime
- A server can change its tool list after it starts, and some clients load tools on demand. Paste a server’s tools/list result to check what it offers now.
- What the servers really do
- The check goes by package names, endpoints, tool names and descriptions. A server can do more than its name says, and a lookalike package can pass for a known one.
- Network egress inside code
- A shell or a code tool reaches whatever its machine can. Your firewall, proxy and sandbox rules aren’t in the configuration.
- Your client
- Whether it renders images and link previews, asks before each tool call, or has tools switched off.
- Who can see what
- Which channels are shared, which repositories are public, who is on a thread. A configuration doesn’t record any of it.
- What reaches the chat
- Untrusted content also arrives in your own prompts, pasted text and uploaded files.
A config can’t show who will see what your agent writes. That’s the audience check, which we’re building now. It checks each message against who can open its sources before it goes out. Pilots get it first.