← All rules

mcp-scan rule

Server mutation

server-mutationmedium

What mcp-scan saw

After the scan, the audit logger recomputed a sha256 over the server's command, args, url, type, sorted env key names, package name, and version, and compared it against the value stored for that client and server in ~/.mcp-scan/known-servers.json. A different hash produces this finding. Only env key names are hashed, never values, so rotating a token does not trip it.

Why it fires

Config drift is how a reviewed server stops being the reviewed server. Anything that can write to your client config, including an installer, an IDE extension, or a sync process, can change a command or add an argument, and nothing else in the system notices. The fingerprint file is the only baseline, so the check is only as good as the first scan that wrote it.

When this is a false positive

  • You changed it. Adding an argument, pinning a version, or renaming an env key all change the hash, and the rule cannot tell your edit from anyone else's.
  • The package version is part of the hash and comes from npm's latest dist-tag, so an upstream release changes the fingerprint without your config changing at all.
  • The baseline lives under ~/.mcp-scan or MCP_SCAN_HOME. A fresh machine, a cleared home directory, or a different MCP_SCAN_HOME means no baseline, and once one is written the first legitimate edit reports.
  • Adding or removing an env key changes the sorted key list even when no value changes.

How to fix it

  1. Diff the config against what you expect. git diff works if the config is tracked; otherwise compare against your last known copy.
  2. If the change is yours, accept it: the next scan rewrites the fingerprint automatically, so the finding does not repeat.
  3. If the change is not yours, find what wrote it. Check recently installed IDE extensions and any config sync you run, then remove the change and rotate anything the server could read.
  4. To rebaseline deliberately, delete the relevant entry from ~/.mcp-scan/known-servers.json and re-scan.
  5. For CI, set MCP_SCAN_HOME to a persistent path if you want this check to mean anything there. A fresh runner has no baseline and can never report.