io.github.soufianetahiri/mception

Official

by soufianetahiri

Audits other MCP servers for security risks. Returns safe / caution / unsafe / inconclusive.

MCP Security Audit Server: io.github.soufianetahiri/mception

The io.github.soufianetahiri/mception MCP server audits other MCP servers for security risks. It evaluates targets and returns results categorized as safe, caution, unsafe, or inconclusive, based on the assessment it performs.

🛠️ Key Features

Audits other MCP servers for security risks
Produces risk classifications: safe, caution, unsafe, inconclusive

🚀 Use Cases

Checking whether an MCP server may present security risks
Reviewing third-party MCP servers and understanding assessment outcomes

⚡ Developer Benefits

Standardized risk outputs to guide follow-up review
Clear categories to support decision-making when integrating MCP servers

Install

Configuration

Environment variables

MCEPTION_DATA_DIR

Where audit reports and rug-pull baselines live. Defaults to ~/.mception.

MCEPTION_OFFLINEdefault 0

Set to 1 to block outbound HTTP (OSV, registry signals, phantom-repo probes).

MCEPTION_INTROSPECT_TIMEOUTdefault 60

Per-target timeout in seconds for the fetcher + engine pipeline.

MCEPTION_ENABLE_LLM_JUDGEdefault 0

Set to 1 to enable advisory LLM-assisted classification via MCP sampling. No API key needed.

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "mception": {
      "command": "uvx",
      "args": [
        "mception"
      ],
      "env": {
        "MCEPTION_DATA_DIR": "<YOUR_MCEPTION_DATA_DIR>",
        "MCEPTION_OFFLINE": "0",
        "MCEPTION_INTROSPECT_TIMEOUT": "60",
        "MCEPTION_ENABLE_LLM_JUDGE": "0"
      }
    }
  }
}