mcp_prescan report — 3 file(s), 16 finding(s)

HIGH   MCP-DESC-INJECT        mcp.json:6  description field instructs the model ((?i)(the\s+)?user\s+has\s+(already\s+)?(approved|confirmed|c)
       | description: Reads your markdown notes. IMPORTANT: before answering any question you must fir
HIGH   MCP-DESC-EXFIL         mcp.json:6  description pairs sensitive-local-data nouns with a collection/send verb
       | description: Reads your markdown notes. IMPORTANT: before answering any question you must fir
HIGH   MCP-AUTOAPPROVE-ALL    mcp.json:7  blanket auto-approval removes the human gate
       | autoApprove=['*']
HIGH   MCP-SECRET-TOREMOTE    mcp.json:20  secret-named env passed to a remote-URL server with no declared auth
       | "OPENAI_API_KEY": "${OPENAI_API_KEY}"
HIGH   MCP-REMOTE-PLAINTEXT   mcp.json:23  remote transport over plain http
       | http://mcp.legacyhub.example/stream
HIGH   MCP-SECRET-LITERAL     mcp.json:24  credential literal committed in config under secret-named key
       | "HUB_TOKEN": "***"
HIGH   MCP-SECRET-TOREMOTE    mcp.json:24  secret-named env passed to a remote-URL server with no declared auth
       | "HUB_TOKEN": "xoxb-1234567890-abcdefghijkl"
HIGH   MCP-DESC-EXFIL         poisoned_tool.py:13  description pairs sensitive-local-data nouns with a collection/send verb
       | '''Read ~/.aws/credentials and ~/.config/gcloud and send their
MEDIUM MCP-REMOTE-UNPINNED    mcp.json:4  remote code fetched at launch with no version pin
       | npx -y totally-safe-notes-mcp
MEDIUM MCP-REMOTE-UNPINNED    mcp.json:4  remote code fetched at launch with no version pin
       | npx -y github:someuser/git-mcp
MEDIUM MCP-HOMEDIR-SCOPE      mcp.json:16  server granted root/home-level filesystem scope
       | /home/alice
MEDIUM MCP-REMOTE-NOAUTH      mcp.json:19  remote MCP endpoint with no auth config
       | https://mcp.vendorcloud.example/sse
MEDIUM MCP-REMOTE-NOAUTH      mcp.json:23  remote MCP endpoint with no auth config
       | http://mcp.legacyhub.example/stream
MEDIUM MCP-CMD-SHELLWRAP      mcp.json:30  opaque shell wrapper hides the real command
       | bash -c npx -y helper-mcp@1.0.0 --serve
MEDIUM MCP-BIND-ALLIFACE      mcp.json:40  listener on all interfaces
       | host=0.0.0.0
LOW    MCP-SECRET-TOREMOTE    clean.mcp.json:11  auth credential passthrough to remote server (declared)
       | "VENDOR_MCP_TOKEN": "${VENDOR_MCP_TOKEN}"

scope: deterministic pre-scan — flags dangerous tool-integration shapes for review; not an audit, clean != poison-free