SkillFoxx

ls-mcp CLI

ls-mcp finds MCP servers across Claude, Cursor and other editors, shows which are running and warns about keys in settings.

  • 84 ★ on the repository
  • Last commit
  • Apache-2.0
CLI

Minimal access

Why this level

  • The tool reads editor configurations and shows found keys, so its output should be treated as secret.
All reasons and checks

lirantal/ls-mcpAuthor:lirantal

Install

In your terminal, with SkillFoxx CLI

npx skillfoxx add cli/ls-mcp

Detects the agents on your machine, shows the access level and pins the version.

Other ways to install

Access and checks

How we review

Minimal accessThe tool runs nothing and makes no network calls.

  • The tool reads editor configurations and shows found keys, so its output should be treated as secret.

This is third-party code. Review the repository files before installing.

What it does

ls-mcp is a command line utility that scans the local environment and lists configured MCP servers. Running `npx ls-mcp` walks application and agentic editor configurations, climbs nested directories to project settings and merges them with global ones. The tool detects which servers are currently running as processes and analyzes environment variables and keys in settings for likely exposed credentials. The `--files` flag limits the check to given files, `--all` also shows empty providers, and `--json` returns a machine readable result with a summary of server counts, running servers and warnings.

Who it is for. Developers and security specialists who need a list of every MCP server on a machine and a check of their settings for leaked keys.

Good fit when

  • You need to see which MCP servers are already configured across editors.
  • Before an audit you must find keys sitting in plain text in server settings.
  • Configuration must be exported as JSON for your own script.
  • A project has `.mcp.json` and it must be compared with global settings.

Not a fit when

  • You need to check the security of MCP servers themselves rather than their settings.
  • You must manage or start servers: the tool only reads.
  • You need a check on a system without Node.js.

Example request

Run `npx ls-mcp --json` and list all found MCP servers, marking those with keys in plain text in their settings.

Limitations

The tool reads configuration files in your home directory and projects, so run it only in a trusted environment and do not publish the whole output. Key analysis is heuristic and may give false positives. The list of supported editors and applications is defined by the tool itself, so give nonstandard paths with `--files`. Process status reflects the moment of launch. Node.js is needed for `npx`. The tool changes and deletes nothing.

How to disable. There is no separate installation: `npx` runs the package without a trace. If installed globally, remove it with `npm uninstall -g ls-mcp`.

FAQ

How do I check a single settings file?

With `--files`: `npx ls-mcp --files ./mcp-config.json`. Several files can be separated by commas or spaces.

How do I show empty providers?

Add `--all` or `-a`. Providers with no servers are hidden by default.

What is the JSON output format?

An object with `mcpFiles` by provider and `summary` with statistics: total servers, running servers, credential warnings and transports.

How do I turn on debugging?

Set `NODE_DEBUG=ls-mcp` to get a verbose log.

Does it find project settings in nested folders?

Yes, it climbs directories and picks up project scoped settings along with global ones.

Discussion

No questions or reviews yet.

CLI tools

MCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing

MCP serverBroad access555

A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.

CLIExtended access166

Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.

CLIMinimal access140
Official

A gateway for MCP servers with plugins for masking known secret patterns in text responses, reputation checks and call logging

MCP serverBroad access403

A CLI for auditing agent MCP servers: inventory, evidence per server and a CI policy where unmeasured never counts as clean

CLIExtended access89

README in short

An MCP server inventory tool: finds settings, detects running processes and flags possible key leaks. Output as a table or JSON.

README badge

Report a problem