MCP server · Security
mcp-latchpoint MCP server
by robyroro
Lets your AI check your MCP config files for risky settings and explain what it finds.
mcp-latchpoint is a small checker for the configuration files that tell AI tools which MCP servers to use. It reads those files on your computer and points out things that look risky, like passwords typed in plain text or commands that could do too much. It is handy if you have collected a few MCP setups and want a second pair of eyes before trusting them.
What is an MCP server? The 30-second version
On its own, your AI can only chat with you. An MCP server is a small helper program that gives your AI one new skill or one connection to another app. This helper connects your AI to mcp-latchpoint, a local checker for MCP configuration files. When you ask, your AI can run a scan through this helper and read back the findings, without ever running the servers listed in those files.
What this MCP server does
You ask your AI to look at one or more MCP configuration files. Your AI passes that request to mcp-latchpoint, which reads only the files you point it at and stays offline. The checker looks for patterns like plain HTTP addresses, shell wrappers, unpinned npx or uvx packages, credentials written in plain text, and very broad access scopes. It then hands back a list of findings with rule IDs, severity, location, and a short fix suggestion, with any secret values replaced by a redacted marker. Your AI shows you that list in the chat.
What you can do with it
- Scan one or more MCP configuration files and get a list of findings
- See which rule was triggered, how serious it is, and where in the file it is
- Get a suggested fix for each finding
- Run the same scan and get results as plain text, JSON, or SARIF
- List all the rules the checker knows about
- Ask for a plain explanation of a single rule by its ID
- Scan a folder of configs while keeping every path inside a folder you trust
Try asking your AI
- “Scan my Claude Desktop config file and tell me what looks risky”
- “Check the .mcp.json in this project and show me the findings as JSON”
- “What does rule MCP004 mean?”
- “List all the rules this checker can apply”
- “Scan the configs folder and only look at files inside it”
What it gives back to you
You get a list of findings, each with a rule ID, a severity, the file and spot where it was found, a short fix suggestion, and a confidence note when the answer depends on the server being launched. Any secret values are shown as field names with a redacted marker instead of the real value. You also get basic scan details, like which files were read. Nothing in the raw configuration is sent back to your AI.
Before you start
What you need
- Python 3.11 or newer
- The mcp-latchpoint package installed on your computer
- The path to a folder you trust, given to the server at startup
- A client that can run a local MCP server, like the Claude desktop app
Good to know
A clean report does not mean a server is safe, and the checker can miss custom flags, so review the findings in context before changing a working setup.
Install it with your AI
Add mcp-latchpoint MCP server to your AI, no technical skills needed
You don't install anything by hand. You copy one prompt, paste it into an AI that can work on your computer, and it checks, installs and connects the server for you, asking you when it needs something.
Sign in to get the install prompt
Members get a ready-made prompt that lets the Claude desktop app check mcp-latchpoint MCP server, install it and connect it for them, step by step. You don't need any technical skills: you copy, paste and answer a few questions. Your connected AI can also find and install any of the 4,609 MCP servers here for you.
Who it's for
People who keep several MCP setups and want a quick, offline safety check before trusting them, especially anyone who is not sure what a config file is really doing.
