Scan
ringzero-mcp scan discovers every MCP server configured across your
repos — Claude Code, OpenCode, VS Code, Cursor, Claude Desktop — and runs
the canonical security checks against each one.
MCP security
Teams wire AI agents to MCP servers faster than anyone reviews them. Every
.mcp.json entry is third-party code (or a third-party endpoint) running with
the agent’s privileges: typosquatted packages one transposition away from the
official server, live secrets committed in server env config, filesystem roots
that hand every session the whole home directory, unpinned versions that
re-resolve latest on each launch, and remote endpoints nobody put through
review.
RingZero treats the MCP config as a first-class security surface.
What RingZero covers
Section titled “What RingZero covers”Policy & allowlist
A reviewable org allowlist in .ringzero/mcp-policy.json: propose →
review → allow. Warn first, enforce when you’re ready.
MCP Registry
An org-controlled catalog that auto-configures approved MCP servers in every harness — pinned versions, no inline secrets, dev contributions via PR, drift caught in CI.
Usage auditing
Harness hooks record every MCP tool call to an append-only local audit log — who called which tool on which server, and what the policy decided.
Harness guards
A Claude Code hook and an OpenCode plugin evaluate each call against your policy live — denying dangerous commands and unapproved servers in enforce mode.
Supported harnesses
Section titled “Supported harnesses”| Harness | Config discovery | Usage recording | Blocking | Integration |
|---|---|---|---|---|
| Claude Code | .mcp.json, ~/.claude.json | ✅ PreToolUse / PostToolUse hooks | Best-effort (see caveat) | ringzero-mcp hook |
| OpenCode | opencode.json[c] | ✅ tool.execute.before/after | Enforce mode, primary session | @ringzero/opencode-mcp-guard |
| VS Code | .vscode/mcp.json | Scan-only | — | discovery only |
| Cursor | .cursor/mcp.json, ~/.cursor/mcp.json | Scan-only | — | discovery only |
| Claude Desktop | claude_desktop_config.json | Scan-only | — | discovery only |
All five harnesses are also MCP Registry sync targets — the org catalog auto-configures approved servers in each one’s config format.
The trust model
Section titled “The trust model”Trust is derived from open findings, never stored — a server’s status can never disagree with its finding list:
| Status | Meaning |
|---|---|
| Flagged | Any open critical or high finding |
| Unverified | Only medium/low findings open |
| Verified | Nothing open |
The org-wide fleet trust score is max(0, 100 − Σ weights) over all open
findings, with weights critical 25 · high 15 · medium 5 · low
2 — deterministic and explainable from the current finding set alone, and
it visibly recovers as you remediate.
The seven checks
Section titled “The seven checks”| Category | Severity | What it looks for | Evaluated by the CLI |
|---|---|---|---|
| Typosquat | critical | Package-name distance vs registry-official servers | ✅ |
| Secrets in config | critical | Credentials inline in server env, args, or URLs | ✅ |
| Excessive scope | high | Capability broader than the project needs (e.g. filesystem root at $HOME) | ✅ |
| Prompt injection | high | Hidden instructions in tool descriptions, aimed at the calling agent | Coming soon (platform) |
| Unpinned version | medium | Server re-resolves latest on every session launch | ✅ |
| Unapproved server | medium | Not on the org allowlist | ✅ (needs a policy) |
| Unsigned package | low | Resolved version published without npm provenance attestation | Coming soon (platform) |
The two platform checks need live registry/server data the local CLI does not
fetch; scan output always lists them in its checks manifest with
evaluated: false and the reason — never silently missing.
Next steps
Section titled “Next steps” Scanner CLI reference Install ringzero-mcp, connect your org, and run the first scan.
Policy & allowlist Bootstrap the org allowlist with propose → review → allow.
MCP Registry Auto-configure approved servers for every developer from one catalog.
Usage auditing Record every MCP tool call and spot exfiltration attempts.
CI integration Gate pull requests on MCP findings and allowlist violations.