Free IDE extension for risk-free vibe coding — keep secrets out of AI.
MCP Security
The Model Context Protocol (MCP) lets AI agents call external tools — file systems, shells, databases, and web services. That power is also the risk: a single over-permissioned or malicious tool can exfiltrate data or run destructive actions. SoterAI IDE Guard scans your MCP configs locally, surfaces what each tool can actually do, and flags risky recommendations before you enable them.
Runs locally in your editor. Secret, PII, prompt-injection, and MCP scanning happen on your machine before anything reaches an AI model.
Detect MCP server definitions in your workspace and review them in one place instead of trusting them blind.
Surface the capabilities each MCP tool requests — file access, shell execution, network — so scope is explicit.
Flag and block over-broad or suspicious MCP tool recommendations before they are added to your setup.
Produce a starting policy that constrains MCP tools to least-privilege defaults you can adjust.
Scan the workspace
Run “Scan MCP Configs” to find MCP server definitions and tool declarations.
Review permissions
Inspect what each tool can do and identify anything broader than the task requires.
Block or constrain
Block risky recommendations and generate a safe baseline policy for the tools you keep.
Re-scan on change
Re-run the scan whenever configs change or a new tool is proposed.
Secure MCP deployments treat every server and tool as a separate trust boundary. A config scanner can expose declared capabilities, but enforcement should also exist at runtime and outside the model.
Allow only required directories and operations. Separate read from write access, block credential locations, and avoid granting an entire home directory when one project folder is enough.
Use command allowlists, argument validation, timeouts, and isolation. Treat arbitrary shell execution as high risk even when a tool description sounds harmless.
Restrict outbound destinations and inject short-lived, scoped credentials at execution time. Do not place reusable production tokens directly in an MCP config.
Require review before payments, deletes, deployments, external messages, permission changes, or other irreversible actions. The model should not approve its own request.
An MCP security scanner is useful for inventory and pre-deployment review, but static configuration is not proof of safe runtime behavior. Combine scanning with isolation, identity, authorization, logging, and continuous review.
A scanner can locate server definitions, exposed commands, environment variables, broad path scopes, suspicious arguments, and known risky permission combinations.
A malicious or compromised server can behave differently from its name or declared purpose. Test untrusted servers in an isolated environment with synthetic data.
Review findings can become a baseline policy that limits tools, paths, commands, destinations, and approval requirements to the current use case.
Permissions can drift and tool behavior can change. Re-scan after updates and enforce authorization, network boundaries, audit logs, and revocation during execution.
No security tool is perfect. Here is what this feature does not claim to do, so you can layer defenses appropriately.
MCP security is the set of controls used to limit how Model Context Protocol servers and tools access files, commands, networks, credentials, and external systems. It includes config scanning, least-privilege permissions, isolation, runtime authorization, approval, logging, and revocation.
Authorize each tool for a specific identity, resource, action, and time window. Keep filesystem, shell, network, and credential scopes narrow; require human approval for high-impact actions; and enforce the decision outside the language model.
A scanner reviews visible MCP server configs for declared tools, broad filesystem or shell access, exposed credentials, risky arguments, network access, and permission combinations. It cannot prove that a server's runtime implementation is safe.
The Model Context Protocol lets AI agents invoke external tools. Because those tools can touch files, shells, and networks, an over-permissioned or malicious tool is a real exfiltration and execution risk — so reviewing permissions before enabling matters.
No. MCP scanning runs locally in the extension. Cloud features are opt-in and disabled in untrusted workspaces.
It can flag over-broad permissions and known risky patterns and help you block or constrain them. It cannot guarantee a tool is safe at runtime, which is why least privilege and isolation still matter.
Install SoterAI IDE Guard and scan secrets, prompts, MCP tools, and terminal commands locally before they ever reach an AI model.
Install for VS Code