mcp-pordego, an open-source MCP security scanner by Jarvis Osorio

mcp-pordego (pordego is Esperanto for gate) is an open-source security scanner for the Model Context Protocol (MCP) servers your agents already use, created by Jarvis Osorio (Jarvis Nelson Osorio). It audits the MCP setups in Claude Desktop, Claude Code, Cursor and VS Code, and flags unpinned packages, inline secrets, prompt-injection in tool descriptions, over-broad filesystem roots, and more.

View the GitHub repository

The project is written in TypeScript, requires Node.js 20 or later and pnpm, and is released under the Apache License 2.0. The current version in the repository is 0.1.0.

v0.1 ships the scanner. A policy gateway, lockfile, redaction proxy, audit log and replay are designed in SPEC.md and the CLI stubs those commands so the surface stays stable, but they are not included in this release. The package is not yet on the npm registry, so do not run npx mcp-pordego. Install from the GitHub repository or the v0.1.0 release asset.

Why

Today, every MCP setup is “give the agent the whole server and hope.” There is no check that a tool description did not smuggle instructions, no alarm when npx floats on @latest, and nothing stopping a PAT from sitting in plaintext in mcp.json.

What v0.1 checks

Static (config only)

Rule	Severity	Check
`unpinned-npx`	high	`npx` package without an exact version, or `@latest`
`unpinned-uvx`	high	`uvx` / `pipx run` without `==version`
`unpinned-docker`	high	image with `:latest` or no tag / digest
`unpinned-git`	high	git URL without a commit SHA
`inline-secret`	high	secret-looking value in `env` / `args` / `headers`
`remote-http-no-tls`	high	`http://` to a non-loopback host
`broad-fs-root`	medium	filesystem server rooted at `/`, `~`, or home
`shell-server`	medium	name or package suggests shell or exec capability

Live (`--live`)

Live mode spawns each stdio server and calls initialize plus tools/list only — never tools/call. High-severity rules include injection phrases, hidden characters, exfil URLs and freeform-exec schemas. Medium and low rules cover hidden markup, cross-tool references, freeform path or URL schemas, tool-name collisions, missing read-only hints and oversized descriptions.

Detection is heuristic. Rules are plain TypeScript modules. The scanner exits 1 on high-severity findings (CI-friendly) and 2 on config or integrity errors.

Quick start

Requires Node.js 20+ and pnpm. From the repository:

git clone https://github.com/JarvisOsorio/mcp-pordego.git
cd mcp-pordego
pnpm install && pnpm build
pnpm scan
# or with an explicit config:
node packages/cli/dist/index.js scan --config ./fixtures/configs/bad-mcp.json

After the build, the CLI is also at node packages/cli/dist/index.js, or the bundled dist/mcp-pordego.cjs from pnpm bundle.

Alternatively, download the v0.1.0 release asset and run it directly:

curl -L -o mcp-pordego.cjs https://github.com/JarvisOsorio/mcp-pordego/releases/download/v0.1.0/mcp-pordego.cjs
node mcp-pordego.cjs scan

The release page is v0.1.0. npm publishing is next; the repository is the source of truth for v0.1.

What it discovers

pnpm scan auto-discovers MCP configs from:

Client	Paths
Claude Desktop	`~/Library/Application Support/Claude/claude_desktop_config.json` (macOS), `%APPDATA%/Claude/…` (Windows), `~/.config/Claude/…` (Linux)
Claude Code	`.mcp.json`, `~/.claude.json`
Cursor	`.cursor/mcp.json`, `~/.cursor/mcp.json`
VS Code	`.vscode/mcp.json`

Point at a file or command

mcp-pordego scan --config ./fixtures/configs/bad-mcp.json
mcp-pordego scan --server "npx -y @modelcontextprotocol/[email protected] /tmp"
mcp-pordego scan --live --config .mcp.json

From a local clone, use node packages/cli/dist/index.js or node mcp-pordego.cjs in place of mcp-pordego until the package is published.

Output formats

mcp-pordego scan --format text          # default, colored, grouped by server
mcp-pordego scan --format json
mcp-pordego scan --format sarif         # GitHub code scanning
mcp-pordego scan --fail-on medium       # high | medium | low (default: high)
mcp-pordego scan --baseline accepted.json

Roadmap (gateway)

Designed, not yet in this release:

Policy-as-code — allow or deny per server and tool, with argument constraints and rate limits
Audit log — hash-chained JSONL of every call
Redaction — strip API keys and tokens from responses
Tool pinning — an mcp-pordego.lock file that blocks silent description changes
Replay — mock or verify recorded sessions

Decisions locked for the v1 gateway: tool pinning on, deny sampling and elicitation by default, and denials returned as MCP results with isError: true (not JSON-RPC errors).

What this is not

Not a sandbox. It inspects configs and tool metadata. It does not isolate upstream server processes.
Heuristics miss things. Encoded injection, novel secret formats and clever shadowing can slip through.
Live mode still trusts the server binary. It only reads tools/list.

The repository includes 39 tests covering static rules, live rules, detectors, discovery and the scan runner (pnpm test). See SECURITY.md and CONTRIBUTING.md.

Source and license

Repository: github.com/JarvisOsorio/mcp-pordego
License: Apache-2.0
Author: Jarvis Osorio (Jarvis Nelson Osorio), technology entrepreneur and AI innovator, based in Miami Beach, Florida
Project site: jarvisosorio.com/mcp-pordego/
Also by Jarvis Osorio: Ambient Memory, a local-first MCP memory layer for Cursor and Claude Desktop
Also by Jarvis Osorio: agentscrub, a local-first CLI that discovers, scans and redacts secrets and PII in AI agent session transcripts

Identity: Jarvis Osorio · Jarvis Nelson Osorio · AI work · Official profiles

Updated: November 13, 2026 (America/New_York)