Large argument list

What mcp-scan saw

The config scanner counted the entries in the args array and reported when the count exceeds 20. It is a plain length check with no inspection of what the arguments contain.

Why it fires

Past about twenty arguments nobody reads the whole line, which is exactly the condition under which an extra path grant or an extra flag gets added without being noticed. The rule is a review prompt rather than a detection, which is why it is LOW and carries a generic recommendation.

When this is a false positive

• A filesystem or workspace server given many directory grants legitimately runs long. Twenty-five explicit directories is a narrower configuration than one home-directory grant.
• A server whose CLI takes many small flags, for example a linter or a build tool wrapper.
• Arguments generated by a launcher or an IDE extension, where the length is not something you chose.
• The count says nothing about risk. Twenty-one harmless flags report and five dangerous ones do not.

How to fix it

1. Read the arguments once, deliberately. That is what the rule is asking for.
2. Remove anything you cannot explain. Long argument lists accumulate flags from configurations that are no longer current.
3. Move stable settings into the env block or a config file the server reads, which shortens the line and makes it reviewable.
4. If the length is legitimate, note it and move on. There is no threshold setting for this rule in .mcp-scan.json.
5. To suppress, add 'large-arg-list' to suppressRules in .mcp-scan.json.