vasikmansuri

Agentconfig Doctor — Security skill for Claude Code

Security community

MCP security scanner & config linter for AI coding agents.

How to install Agentconfig Doctor

This entry records only its repository, not the path inside it, so there is no exact command to give. Open vasikmansuri/agentconfig-doctor and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Agentconfig Doctor does

MCP security scanner & config linter for AI coding agents. Finds leaked secrets, risky commands, broad permissions and invalid MCP servers in Claude Code, Cursor and VS Code (Copilot) configs. Local-first CLI, no telemetry.

Alternatives in Security

Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★
Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
Agentseal — Security toolkit for AI agents 344 ★

README

AgentConfig Doctor: MCP and AI Coding-Agent Config Security Scanner

[![CI](https://github.com/vasikmansuri/agentconfig-doctor/actions/workflows/ci.yml/badge.svg)](https://github.com/vasikmansuri/agentconfig-doctor/actions/workflows/ci.yml) [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)

**Catch leaked keys, dangerous commands and over-broad permissions in your AI coding-agent configuration before you commit or share it.**

AgentConfig Doctor is an open-source **MCP security scanner** and config linter for **Claude Code, Cursor and VS Code (GitHub Copilot)**. This local-first CLI checks `.mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, `.claude/settings.json`, Cursor rules, `CLAUDE.md` and `AGENTS.md` for:

exposed secrets and API keys
risky shell commands, such as curl | sh in hooks or MCP servers
broad filesystem permissions
invalid or suspicious MCP server definitions
permission changes in pull requests

Every finding explains what it saw, why it matters and how to fix it. It needs no AI API and no account, sends no telemetry, and never runs the commands it inspects.

**Use it to:** validate an MCP config file, audit Claude Code permissions, lint Cursor MCP servers, scan AI agent configs for secrets in CI, or review a repository's agent setup before you trust it.

Status: **0.1.0, pre-release.** The CLI is feature-complete for its first release and tested, but has not been published to npm yet. Until then, [run it from source](#from-source).