Latchpoint MCP server

mcp-latchpoint

<!-- mcp-name: io.github.robyroro/mcp-latchpoint -->

mcp-latchpoint audits MCP client configuration files without running the configured servers. It works offline, reads only local files you select, and produces text, JSON, or SARIF results.

This is an early defensive tool. Review findings in context before changing a working configuration.

What it checks

The v0.1 rules cover:

• plain HTTP for non-loopback remote endpoints
• shell wrappers and inline shell control syntax
• identifiable npx and uvx packages without exact versions
• literal credentials in environment values, headers, arguments, or URLs
• filesystem roots and home roots passed as recognizable access scopes
• wildcard hosts and recognizable wildcard scopes
• conflicting, missing, invalid, or unsupported transport settings

Every finding has a stable rule ID, severity, location, remediation, redacted evidence, and a confidence note when interpretation depends on the launched server.

Install

Python 3.11 or newer is required.

python -m pip install mcp-latchpoint

To install from a local checkout:

python -m venv .venv
# Linux or macOS
. .venv/bin/activate
# Windows PowerShell
.venv\Scripts\Activate.ps1
python -m pip install .

For development:

python -m pip install -e ".[dev]"
pytest
ruff check .
mypy

The MCP server uses the official Python SDK v2 and the dependency is constrained to mcp>=2.3,<3.

CLI

Scan one or more explicit files:

mcp-latchpoint scan ~/.config/Code/User/mcp.json
mcp-latchpoint scan examples/risky.json --format json
mcp-latchpoint scan examples/risky.json --format sarif --fail-on high > results.sarif

Restrict every explicit path to an approved directory:

mcp-latchpoint scan ./configs --allowed-root ./configs

Directories are searched only for recognized MCP config filenames, up to 256 files. A file is limited to 1 MiB by default. Change these bounds with --max-files and --max-bytes.

Exit codes are 0 for a completed scan below the chosen threshold, 1 when a finding meets --fail-on, and 2 for input, containment, or parse errors. The default --fail-on none reports findings without failing a build.

List and explain rules:

mcp-latchpoint rules
mcp-latchpoint explain MCP004

Recognized layouts

Explicit files may use these structures:

Files ending in .jsonc are also parsed as JSONC. Other .json files remain strict JSON so malformed input is not silently accepted.

--discover checks only the following paths when they exist. It does not search the rest of the home directory.

• All systems: ~/.claude.json, ~/.cursor/mcp.json, ~/.codex/config.toml, $COPILOT_HOME/mcp-config.json with ~/.copilot/mcp-config.json as the fallback
• Current project: .mcp.json, .codex/config.toml, .cursor/mcp.json, .vscode/mcp.json
• Windows: %APPDATA%\Claude\claudedesktopconfig.json, %APPDATA%\Code\User\mcp.json
• macOS: ~/Library/Application Support/Claude/claudedesktopconfig.json, ~/Library/Application Support/Code/User/mcp.json
• Linux: $XDGCONFIGHOME/Code/User/mcp.json, falling back to ~/.config/Code/User/mcp.json

Read-only MCP server

The stdio server exposes two tools: list_rules and scan. It requires an allowed root at startup. Relative scan paths are resolved below that root; absolute paths, .. traversal, and symlinks cannot escape it.

Shortened. The full README is on GitHub.