Security posture for AI agents and MCP servers

Know what your AI agents can reach.

Your team connects Claude, Cursor and VS Code to databases, GitHub and file systems through MCP servers, usually by pasting config from the internet. Permiscope keeps the list of every one of them, flags the risky ones, and tells you when something changes.

Create your workspace See how it works

Read-only scans · secrets redacted on the device · data stored in the EU

permiscope.app · Security Findings
10
devices
37
MCP servers
4
need attention
  • HIGH
    Credential embedded in MCP configuration
    github · Claude Code · anna-mbp
  • HIGH
    Download piped into an interpreter
    tools · Cursor · marek-mbp
  • MED
    Package version not pinned
    postgres · VS Code · ci: acme/api
  • MED
    Filesystem server with a broad root
    files · Claude Desktop · ola-mbp
New server added on marek-mbp · sent to #security-alerts

Nobody has the list

MCP servers live in a dozen config files per laptop. IT can't see them; developers forget them.

Secrets in plain text

Setup guides put API keys straight into the config, where every agent and backup can read them.

Code that changes itself

Unpinned npx servers fetch whatever is newest at every start: a supply-chain risk on every laptop.

How it works

One command per Mac. Then it runs itself.

No agents in your traffic, no proxies, nothing to configure per developer.

  1. 1. Install

    Run the installer on a Mac, or push it through Jamf, Kandji or Intune. It brings its own runtime and stores its token in the Keychain.

  2. 2. Scan daily

    Every morning and at login it reads the AI clients' config files, including projects they have opened, redacts secrets and uploads the result.

  3. 3. Review and act

    See every server and finding in one place, approve a baseline, and get alerted by email, Slack or Teams when something drifts.

# on a Mac
$ curl -fsSLo permiscope-install.sh https://permiscope.app/install.sh
$ sh permiscope-install.sh
What it finds

The mistakes that actually show up in MCP configs

Deterministic rules on declared configuration. Every finding shows its evidence and a fix, never the secret itself.

HIGH

Credentials pasted into config

API keys and tokens written inline in env, headers, arguments or URLs, instead of read from a secret store.

HIGH

Download piped into a shell

Servers started through shell strings, including the classic curl … | sh pattern.

HIGH

Containers with host access

Docker-based servers running privileged, on the host network, or with the Docker socket mounted.

MEDIUM

Unpinned packages

npx and uvx servers without a version, so every start can fetch and run different code.

MEDIUM

Unusual package sources

Packages pulled from a non-default registry, a git URL or a tarball.

MEDIUM

Remote servers over plain HTTP

Unencrypted connections, rated higher when credentials travel with them.

MEDIUM

Filesystem access to everything

File servers rooted at / or the whole home folder instead of one project.

Covers

Claude Code, Claude Desktop, Cursor and VS Code, project configs in the folders they open, and Claude Code's organization-managed config.

Built for teams

From one laptop to the whole company

Inventory

Every MCP server across devices and repositories: which client, which transport, which package and version, and where it came from.

Drift detection

Approve what's normal once. New, changed or removed servers become a change to review, with a field-by-field diff.

Triage with expiry

Assign findings, comment, mark false positives, or accept a risk until a date. Expired exceptions reopen on their own.

Alerts where you work

Email, Slack or Microsoft Teams, filtered by severity and de-duplicated, so the same issue doesn't ping you twice.

Pull request checks

A GitHub Actions step annotates risky MCP config on the exact line of the pull request and can fail the check.

Reports

A one-page security report as PDF for management or auditors, and CSV exports of findings.

Security

A security tool that behaves like one

Passive by design

Scans only read configuration files. They never start an MCP server, install a package, or call a tool.

Secrets stay on the laptop

Values of env variables, headers and credential-like arguments are redacted on the device, and redacted again on the server.

Isolated per organization

Every tenant's data is separated by row-level security in the database, not just by application code.

Stored in the EU

Your organization's data is stored in Frankfurt. Fonts and assets are self-hosted: no third-party trackers.

Least privilege everywhere

Per-device tokens bound to one machine, roles from viewer to owner, two-factor sign-in, and an audit log.

Verified updates

The installer and daily self-update check SHA-256 checksums before anything runs.

Find out what your agents can reach today.

Create a workspace, install on your own Mac, and see the first results in a minute.

Get started