correctover-scan
Advanced tools
Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.
Copyright (c) 2026 Guigui Wang.
Starting with version 3, this project is licensed under the
Elastic License 2.0 (SPDX: Elastic-2.0). You may use, modify, and
self-host the software, but you may not offer it to third parties as a hosted
or managed service. See LICENSE for the full terms.
All versions released before 3 (including the 1.x line and the 2.x compatibility shells) remain available under their original license terms; the license change is not retroactive.
Security scanner for MCP servers and AI agents — detects credential exposure, SSRF, command injection risk and missing auth across your MCP configuration. 14 checks mapped to OWASP AISVS 1.0. Run anywhere with
npx correctover-scan.
correctover-scan audits the MCP (Model Context Protocol) configuration files used by Claude Code, Claude Desktop, Cursor, VS Code and other AI agent tools. It scans for credential leaks, SSRF exposure, missing transport encryption, over-broad tool permissions and more — 14 security checks covering the issues that turn MCP integrations into RCE, data exfiltration and prompt-injection paths. Zero install: npx correctover-scan runs locally, works in CI, and outputs SARIF for GitHub code scanning.
v1.4.0 adds a second mode: --bundle code-layer signal scanning for published npm packages and bundled/minified JavaScript — 17 checks over shipped code, with file+line findings, minified-code reformatting and context-based false-positive suppression.
Zero config, no account, no sign-up — scan the current directory for MCP configuration issues:
npx correctover-scan@latest
It auto-detects MCP config files (.cursor/mcp.json, claude_desktop_config.json, .claude/mcp.json, mcp.json, .vscode/mcp.json and more) and runs 14 checks. Everything runs locally on your machine — config files are not uploaded.
免费的自动扫描覆盖配置层面的风险检查。如果你需要人工深度审计或正式合规凭证，可以在支付宝 SkillPay 货架获取：
请通过 SkillPay 购买并安装 Skill「MCP配置安全体检」请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」请通过 SkillPay 购买并安装 Skill「CCS收据验签」Beyond the free scan: human-led deep audits and compliance evidence are available on the Alipay SkillPay shelf — open the link above, or type the service name (e.g. MCP配置安全体检) in an agent with Alipay AI Pay enabled.
# Scan a specific config file
npx correctover-scan mcp.json
# Recursively scan a project directory
npx correctover-scan -d ./my-project -r
# SARIF output for GitHub code scanning
npx correctover-scan mcp.json -f sarif > report.sarif
| # | Check | Severity | AISVS |
|---|---|---|---|
| 1 | TLS Transport Encryption | 🔴 Critical | C10.1 |
| 2 | Server Authentication | 🟠 High | C10.2 |
| 3 | Timeout Configuration | 🟡 Medium | C9.1 |
| 4 | Credential Exposure | 🔴 Critical | C5.1 |
| 5 | Tool Allowlist | 🟠 High | C9.3 |
| 6 | Token Budget Control | 🟠 High | C9.1 |
| 7 | SSRF Protection | 🔴 Critical | C10.3 |
| 8 | Audit Logging | 🟡 Medium | C12.1 |
| 9 | Sandbox Isolation | 🟡 Medium | C4.1 |
| 10 | Dependency Version Pinning | 🟡 Medium | C6.1 |
| 11 | Error Handling Strategy | 🟡 Medium | C12.2 |
| 12 | Input Validation | 🟠 High | C2.1 |
| 13 | Output Validation | 🟡 Medium | C7.1 |
| 14 | Kill Switch | 🟠 High | C9.5 |
# Terminal (default)
correctover-scan mcp.json
# JSON
correctover-scan mcp.json -f json
# SARIF (for CI integration)
correctover-scan mcp.json -f sarif > report.sarif
Auto-detects these files:
.cursor/mcp.jsonclaude_desktop_config.json.claude/mcp.jsonmcp.json / mcp.yaml / mcp.yml.vscode/mcp.json.mcp/mcp.jsonconfig/mcp.json# Audit an unpacked npm package: reads package.json entry (main/module/bin)
# and every .js/.mjs/.cjs/.ts file in the tree (node_modules skipped)
npx correctover-scan@latest --bundle ./node_modules/some-pkg
npx correctover-scan@latest -b ./pkg # -b is shorthand for --bundle
# Audit a single minified/bundled JS file
npx correctover-scan@latest --bundle dist/app.min.js
# A positional .js/.mjs/.cjs/.ts target auto-selects bundle mode
npx correctover-scan@latest ./cli.js
# Outputs: text (default), JSON, or SARIF with file+line locations
npx correctover-scan@latest -b ./pkg -f json
npx correctover-scan@latest -b ./pkg -f sarif > bundle.sarif
npx correctover-scan@latest -b ./pkg -o report.txt # write the report to a file
npx correctover-scan@latest -b ./pkg -f json -o bundle.json
Exit code is 1 when any check produces a fail-level finding — drop the command straight into CI.
Bundle mode is signal scanning over shipped/minified code. Minifiers rename local variables, but property names, string literals, URLs, environment-variable names and error messages survive bundling — so the attack-surface signals the checks rely on are still present in the published artifact.
shell:true/exec subprocess calls, dynamic eval/Function/vm, plaintext endpoints, MCP transport auth, permission gates, missing timeouts/kill-switch/input validation, env-credential flow, sandbox signals.shell:false fixed-argument spawn calls, sandbox VM implementations, localhost/spec-namespace URLs and placeholder/example strings.Honest scope: bundle mode does not prove reachability or intent — a signal that is located correctly may still be unreachable in practice, and conclusions on the semi-automatic checks remain a manual-review job. It is an automated triage layer that points a reviewer at the exact lines to examine; it does not replace the 116-check manual audit methodology, where reviewers trace data flow and what each capability can actually be made to do. Scanning covers JavaScript/TypeScript code, configuration and protocol-layer signals; deep logic compiled into native binaries (e.g. Bun --compile single-file executables) is outside static analysis and is not covered by bundle mode. Everything runs locally — package code is not uploaded.
Check ids continue the config scanner's 14-check scheme so text/JSON/SARIF outputs stay aligned.
| # | Check | Type | Severity | AISVS |
|---|---|---|---|---|
| 1 | Hardcoded credentials in code (sk-/ghp_/AKIA/AIza/xox patterns, placeholder-aware) | automatic | 🔴 Critical | C5.1 |
| 2 | Plaintext HTTP outbound endpoints (localhost/spec/example hosts suppressed) | automatic | 🟠 High | C10.1 |
| 3 | Cloud metadata & intranet addresses / SSRF (169.254.x, RFC1918, GCP metadata; cloud-SDK & guard context suppressed) | automatic | 🔴 Critical | C10.3 |
| 4 | Subprocess execution — shell:true / exec (shell:false fixed-arg spawn not flagged) | automatic | 🟠 High | C4.1 |
| 5 | Dynamic code execution — eval / new Function / vm (sandbox/shim contexts suppressed) | automatic | 🟠 High | C4.1 |
| 6 | Environment-variable credential flow (hardcoded fallback secrets flagged) | automatic | 🟡 Medium | C5.1 |
| 7 | Permission modes & tool gates (allowedTools, dangerouslySkipPermissions) | automatic | 🟠 High | C9.3 |
| 8 | MCP transport authentication (remote sse/http/ws without Authorization signal) | automatic | 🟠 High | C10.2 |
| 9 | Timeout & interruption signals (AbortSignal.timeout / timeout options) | automatic | 🟡 Medium | C9.1 |
| 10 | Kill switch — AbortController / AbortSignal presence | automatic | 🟠 High | C9.5 |
| 11 | Sandbox isolation signals (bwrap / sandbox manager) | automatic | 🟡 Medium | C4.1 |
| 12 | Input validation / schema signals | automatic | 🟠 High | C2.1 |
| 13 | Token budget constants (MAX_*_TOKENS / cost limits) | semi-automatic | 🟠 High | C9.1 |
| 14 | Audit logging / telemetry endpoints | semi-automatic | 🟡 Medium | C12.1 |
| 15 | Supply chain / vendor SBOM (native artifacts, vendor versions) | semi-automatic | 🟡 Medium | C6.1 |
| 16 | Error handling / retry / fallback | semi-automatic | 🟡 Medium | C12.2 |
| 17 | Output truncation / filtering | semi-automatic | 🟡 Medium | C7.1 |
The free-tier daily scan allowance applies to bundle scans too (counted the same way as config scans); a Pro license removes the limit. License verification runs sub-millisecond on the core verification hot path.
- uses: DSHCorrectover/correctover-scan-action@v1
with:
path: ./mcp.json
Try the no-install browser version (files never leave your machine): in-browser scanner
The free automated scan covers surface-level configuration checks. A manual Correctover audit goes deeper:
For first customers, if the manual audit finds no critical-severity issue, you pay nothing.
CCS (Correctover Conformance Shape) is published as an individual Internet-Draft: draft-correctover-ccs.
An Internet-Draft is an individual submission. It is not an RFC, an adopted working-group item, or IETF endorsement; the Datatracker page is authoritative for revision and status.
Elastic License 2.0 © Guigui Wang.
This CLI is free to use, modify and self-host under the Elastic License 2.0: use it in your terminal, CI, and agent hooks (such as the Kimi Code security hook), and redistribute it under those terms. You may not offer it to third parties as a hosted or managed service. External pull requests are welcome. See LICENSE for the full terms.
The commercial products — the hosted zero-upload scan platform, the CCS runtime verification engine, and the manual Agent Output Audit service — are proprietary and are not part of this release. See correctover.com for those.
FAQs
Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.
The npm package correctover-scan receives a total of 42 weekly downloads. As such, correctover-scan popularity was classified as not popular.
We found that correctover-scan demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.
Security News
Cloudflare introduces tsrs, a Rust port of TypeScript’s compiler promising faster checks and lower memory use, with the TypeScript team’s help.
Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.