Product · MCP security
Review the MCP servers your agents load
An MCP configuration can give an agent access to local programs and remote services. RingZero helps teams review that configuration: discover declared servers, flag risky settings, maintain an approved catalog, and record policy decisions in supported harnesses. The CLI works locally without an account; uploads connect its results to your RingZero organization.
Start with the configuration you already have
Run ringzero-mcp scan against a repository to discover Claude Code,
VS Code, Cursor, and OpenCode configuration. Add --machine for supported
user-level configuration, including Claude Desktop. The scanner reads the files;
it does not start servers or connect to their endpoints. See the
scanner guide
for supported paths and setup.
Upload a scan with a scoped API key to make its server inventory and findings available in the app and API. The current organization inventory reflects the latest uploaded scan. Scan all intended locations together when you need a combined inventory; independent uploads do not accumulate into a historical fleet catalog.
Know which checks run today
- Typosquats: flag package names close to known official names.
- Secrets in config: identify likely credentials stored inline in environment values, headers, URLs, or arguments.
- Excessive scope: flag broad filesystem paths, host-root mounts, and unsafe configuration patterns.
- Unpinned versions: identify supported package, container, and Git sources that can change between launches.
- Unapproved servers: compare servers with the policy allowlist or approved registry catalog.
Coming soon: prompt-injection checks on live tool descriptions, package provenance checks, and publisher/registry enrichment. The CLI marks checks it cannot evaluate in its output. A clean configuration scan does not establish that the server's implementation or tool descriptions are safe.
Distribute an approved catalog
The MCP Registry
stores a reviewable catalog of approved servers with pinned sources and environment
references for secrets. Developers can propose internal servers through changes to
that catalog. registry sync projects managed entries into supported
harness configuration while preserving unmanaged entries; sync --check
reports drift in CI.
Organizations can manage catalog entries through the app or API. An Owner sets the organization control level: open, monitored, or strict. Clients pull the catalog and control level for local policy decisions. Team enablement, per-repository overrides, and scoped effective catalogs are coming soon.
Audit supported calls and review trust signals
Optional Claude Code hooks and the OpenCode guard record supported tool calls and evaluate them against policy. Arguments are hashed by default. Blocking depends on the harness: Claude Code enforcement is best-effort, and OpenCode subagent calls are not covered. Other supported harnesses can use scanning and registry sync without call-time auditing.
The server inventory derives Verified, Unverified, or Flagged from the evaluated findings. The trust score summarizes those findings with severity weights. Use it to prioritize review, alongside the scanner's coverage and limitations.
Review a fix before changing configuration
Today, findings guide manual configuration changes. The interactive homepage demo previews the planned config-diff and approval workflow using sample data. AI-generated diffs and automatic pull requests through automated remediation are coming soon. Dependency advisory matching is available separately through supply chain scanning; authorized AI pentesting is a planned capability.
Frequently asked questions
Does RingZero detect MCP tool poisoning today?
Tool poisoning puts malicious instructions in tool descriptions that an agent may treat as context. RingZero’s current CLI reads configuration without connecting to servers, so it does not inspect live tool descriptions. Prompt-injection analysis is coming soon and is explicitly marked unevaluated in scan output.
How does RingZero detect typosquatted MCP servers?
The local scanner compares package names against known official names using spelling-distance heuristics. It does not currently fetch publisher ages, download counts, install scripts, or provenance attestations. Registry enrichment is planned; a spelling match is a review signal, not proof of malicious code.
Does it cover remote HTTP MCP servers?
Yes. RingZero discovers HTTP endpoints in supported config files and checks applicable configuration risks, including secrets and allowlist approval. It does not connect to those endpoints, inspect their tool descriptions, or verify their runtime behavior.
What does a fix look like?
Today, use the findings to review and edit the affected harness config: remove inline secrets, narrow access, pin a version, or choose an approved server. The homepage demo previews proposed config diffs and approval flows. AI-generated fixes and automatic pull requests are coming soon.
What does Verified mean?
Verified means the evaluated checks found no open issues for that server. Flagged means an open critical or high finding; Unverified means only medium or low findings. These statuses describe the current check results, not a certification that a server is safe. The trust score weights open findings by severity.
Does RingZero run or proxy my MCP servers?
The scanner reads local MCP configuration without running or proxying the configured servers. Optional Claude Code and OpenCode integrations evaluate supported tool calls and record policy decisions. Claude Code blocking is best-effort; the OpenCode guard does not cover subagent tool calls.