correctover-scan
Advanced tools
Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.
Security scanner for MCP servers and AI agents — detects credential exposure, SSRF, command injection risk and missing auth across your MCP configuration. 14 checks mapped to OWASP AISVS 1.0. Run anywhere with
npx correctover-scan.
correctover-scan audits the MCP (Model Context Protocol) configuration files used by Claude Code, Claude Desktop, Cursor, VS Code and other AI agent tools. It scans for credential leaks, SSRF exposure, missing transport encryption, over-broad tool permissions and more — 14 security checks covering the issues that turn MCP integrations into RCE, data exfiltration and prompt-injection paths. Zero install: npx correctover-scan runs locally, works in CI, and outputs SARIF for GitHub code scanning.
v1.4.0 adds a second mode: --bundle code-layer signal scanning for published npm packages and bundled/minified JavaScript — 17 checks over shipped code, with file+line findings, minified-code reformatting and context-based false-positive suppression.
Zero config, no account, no sign-up — scan the current directory for MCP configuration issues:
npx correctover-scan@latest
It auto-detects MCP config files (.cursor/mcp.json, claude_desktop_config.json, .claude/mcp.json, mcp.json, .vscode/mcp.json and more) and runs 14 checks. Everything runs locally on your machine — config files are not uploaded.
# Scan a specific config file
npx correctover-scan mcp.json
# Recursively scan a project directory
npx correctover-scan -d ./my-project -r
# SARIF output for GitHub code scanning
npx correctover-scan mcp.json -f sarif > report.sarif
| # | Check | Severity | AISVS |
|---|---|---|---|
| 1 | TLS Transport Encryption | 🔴 Critical | C10.1 |
| 2 | Server Authentication | 🟠 High | C10.2 |
| 3 | Timeout Configuration | 🟡 Medium | C9.1 |
| 4 | Credential Exposure | 🔴 Critical | C5.1 |
| 5 | Tool Allowlist | 🟠 High | C9.3 |
| 6 | Token Budget Control | 🟠 High | C9.1 |
| 7 | SSRF Protection | 🔴 Critical | C10.3 |
| 8 | Audit Logging | 🟡 Medium | C12.1 |
| 9 | Sandbox Isolation | 🟡 Medium | C4.1 |
| 10 | Dependency Version Pinning | 🟡 Medium | C6.1 |
| 11 | Error Handling Strategy | 🟡 Medium | C12.2 |
| 12 | Input Validation | 🟠 High | C2.1 |
| 13 | Output Validation | 🟡 Medium | C7.1 |
| 14 | Kill Switch | 🟠 High | C9.5 |
# Terminal (default)
correctover-scan mcp.json
# JSON
correctover-scan mcp.json -f json
# SARIF (for CI integration)
correctover-scan mcp.json -f sarif > report.sarif
Auto-detects these files:
.cursor/mcp.jsonclaude_desktop_config.json.claude/mcp.jsonmcp.json / mcp.yaml / mcp.yml.vscode/mcp.json.mcp/mcp.jsonconfig/mcp.json# Audit an unpacked npm package: reads package.json entry (main/module/bin)
# and every .js/.mjs/.cjs/.ts file in the tree (node_modules skipped)
npx correctover-scan@latest --bundle ./node_modules/some-pkg
npx correctover-scan@latest -b ./pkg # -b is shorthand for --bundle
# Audit a single minified/bundled JS file
npx correctover-scan@latest --bundle dist/app.min.js
# A positional .js/.mjs/.cjs/.ts target auto-selects bundle mode
npx correctover-scan@latest ./cli.js
# Outputs: text (default), JSON, or SARIF with file+line locations
npx correctover-scan@latest -b ./pkg -f json
npx correctover-scan@latest -b ./pkg -f sarif > bundle.sarif
npx correctover-scan@latest -b ./pkg -o report.txt # write the report to a file
npx correctover-scan@latest -b ./pkg -f json -o bundle.json
Exit code is 1 when any check produces a fail-level finding — drop the command straight into CI.
Bundle mode is signal scanning over shipped/minified code. Minifiers rename local variables, but property names, string literals, URLs, environment-variable names and error messages survive bundling — so the attack-surface signals the checks rely on are still present in the published artifact.
shell:true/exec subprocess calls, dynamic eval/Function/vm, plaintext endpoints, MCP transport auth, permission gates, missing timeouts/kill-switch/input validation, env-credential flow, sandbox signals.shell:false fixed-argument spawn calls, sandbox VM implementations, localhost/spec-namespace URLs and placeholder/example strings.Honest scope: bundle mode does not prove reachability or intent — a signal that is located correctly may still be unreachable in practice, and conclusions on the semi-automatic checks remain a manual-review job. It is an automated triage layer that points a reviewer at the exact lines to examine; it does not replace the 116-check manual audit methodology, where reviewers trace data flow and what each capability can actually be made to do. Scanning covers JavaScript/TypeScript code, configuration and protocol-layer signals; deep logic compiled into native binaries (e.g. Bun --compile single-file executables) is outside static analysis and is not covered by bundle mode. Everything runs locally — package code is not uploaded.
Check ids continue the config scanner's 14-check scheme so text/JSON/SARIF outputs stay aligned.
| # | Check | Type | Severity | AISVS |
|---|---|---|---|---|
| 1 | Hardcoded credentials in code (sk-/ghp_/AKIA/AIza/xox patterns, placeholder-aware) | automatic | 🔴 Critical | C5.1 |
| 2 | Plaintext HTTP outbound endpoints (localhost/spec/example hosts suppressed) | automatic | 🟠 High | C10.1 |
| 3 | Cloud metadata & intranet addresses / SSRF (169.254.x, RFC1918, GCP metadata; cloud-SDK & guard context suppressed) | automatic | 🔴 Critical | C10.3 |
| 4 | Subprocess execution — shell:true / exec (shell:false fixed-arg spawn not flagged) | automatic | 🟠 High | C4.1 |
| 5 | Dynamic code execution — eval / new Function / vm (sandbox/shim contexts suppressed) | automatic | 🟠 High | C4.1 |
| 6 | Environment-variable credential flow (hardcoded fallback secrets flagged) | automatic | 🟡 Medium | C5.1 |
| 7 | Permission modes & tool gates (allowedTools, dangerouslySkipPermissions) | automatic | 🟠 High | C9.3 |
| 8 | MCP transport authentication (remote sse/http/ws without Authorization signal) | automatic | 🟠 High | C10.2 |
| 9 | Timeout & interruption signals (AbortSignal.timeout / timeout options) | automatic | 🟡 Medium | C9.1 |
| 10 | Kill switch — AbortController / AbortSignal presence | automatic | 🟠 High | C9.5 |
| 11 | Sandbox isolation signals (bwrap / sandbox manager) | automatic | 🟡 Medium | C4.1 |
| 12 | Input validation / schema signals | automatic | 🟠 High | C2.1 |
| 13 | Token budget constants (MAX_*_TOKENS / cost limits) | semi-automatic | 🟠 High | C9.1 |
| 14 | Audit logging / telemetry endpoints | semi-automatic | 🟡 Medium | C12.1 |
| 15 | Supply chain / vendor SBOM (native artifacts, vendor versions) | semi-automatic | 🟡 Medium | C6.1 |
| 16 | Error handling / retry / fallback | semi-automatic | 🟡 Medium | C12.2 |
| 17 | Output truncation / filtering | semi-automatic | 🟡 Medium | C7.1 |
The free-tier daily scan allowance applies to bundle scans too (counted the same way as config scans); a Pro license removes the limit. License verification runs sub-millisecond on the core verification hot path.
- uses: DSHCorrectover/correctover-scan-action@v1
with:
path: ./mcp.json
Try the no-install browser version (files never leave your machine): in-browser scanner
The free automated scan covers surface-level configuration checks. A manual Correctover audit goes deeper:
For first customers, if the manual audit finds no critical-severity issue, you pay nothing.
CCS (Correctover Conformance Shape) is published as an individual Internet-Draft: draft-correctover-ccs.
An Internet-Draft is an individual submission. It is not an RFC, an adopted working-group item, or IETF endorsement; the Datatracker page is authoritative for revision and status.
MIT © Correctover.
This CLI is a free, open-source lead-generation tool (MIT-licensed): use it in your terminal, CI, and agent hooks (such as the Kimi Code security hook), fork it, and redistribute it under the MIT terms. External pull requests are welcome.
The commercial products — the hosted zero-upload scan platform, the CCS runtime verification engine, and the manual Agent Output Audit service — are proprietary and are not part of this open-source release. See correctover.com for those.
We audit key-generation, signing, and runtime-verification paths for wallets, exchanges, and AI infrastructure — black-box, evidence-grade deliverables (signed receipts, RFC 3161 timestamps). Recent public work includes corrections incorporated into CVE-2026-73567's advisory and independently discovered high-severity findings in AI-lab infrastructure.
FAQs
Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.
The npm package correctover-scan receives a total of 834 weekly downloads. As such, correctover-scan popularity was classified as not popular.
We found that correctover-scan demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.