MCP Risk Review
Fix before rollout, in four changes
The scanner called this setup nearly clean. Reading the config and the servers' own docs found four things it cannot see.
Decision
Fix before rollout. The scan found 0 critical, 0 high and 1 medium issue, and the medium is fine to accept. The four changes below come from reading, not from scanner output, and they take about an hour once the fetch decision is made.
The subject is a reference setup. The repository says its servers are reference implementations and not production-ready (README.md:9). So this memo answers a narrower question: if a team copied this documented config into a real rollout, would we sign off? Not yet.
What we reviewed
The repository ships no combined config. We copied the Claude Desktop example from each server's README (seven servers) and added the repo's own .mcp.json entry. For fetch we used the README's Windows variant, which adds an environment block. Placeholder paths such as /Users/username/Desktop stay as documented. The file is in the appendix, so you can run the same scan.
No server was started and no live tool list was read. Because the launch commands are unpinned, a re-run on a later day can differ.
What the scanner reported
mcp-docs contacts an endpoint the scanner does not know
- Where
config line 35
- Observed
- The only finding in the default online run. The other seven servers scored 0 issues.
- Evidence
MEDIUM network-egress-unknown Server contacts unknown external endpoint: https://modelcontextprotocol.io/mcp
- Why it matters
- An unknown host is a prompt to look, not a defect. This one is the project's own docs host, the same entry its repo declares in .mcp.json.
- Fix
- Accept it and write the host into an allowlist, so the next unfamiliar host stands out.
Two advisories on the filesystem server, closed after a check
- Where
config line 5
- Observed
- Appeared only in the --offline run, where the bundled snapshot cannot confirm which version npx would install. Both advisories (GHSA-hc55-p739-j48w and GHSA-q66q-fx2p-7w4m) are fixed in 2025.7.1, and the online run resolved the package to 2026.8.31.
- Evidence
LOW known-vulnerability-unresolved Package '@modelcontextprotocol/server-filesystem' has 2 known advisories (GHSA-hc55-p739-j48w, GHSA-q66q-fx2p-7w4m) in the offline snapshot (recorded against version 2026.7.10), but the resolved version could not be confirmed against it while offline. This is not a confirmed vulnerability - verify manually.
- Why it matters
- Not affected at the version a launch resolves today. A scanner flags it, a person closes it.
- Fix
- None needed. Pinning the version (fix 1 below) makes the answer stable offline too.
What reading it found
The scanner scored every server below as clean. Severity is our call, against a local, single-user machine.
Seven servers can resolve a newer release on a later run
- Where
config lines 5, 9, 14, 18config lines 22, 27, 31
- Observed
- Four npx servers use -y with no version, three uvx servers name no version. The scan scored all seven clean, and mcp-scan 2.0.13 has no standalone finding for an unpinned spec.
- Why it matters
- A release published after your review can run on your machine with your files in reach, and nothing shows you the diff. Your review is only as current as the last run that resolved a version.
- Fix
- Pin each server to the version you reviewed, for example @modelcontextprotocol/server-filesystem@2026.8.31 and mcp-server-fetch@2026.8.18 (the newest releases on 2026-10-09). Re-review on every bump.
Filesystem and git can change your files, and the grant is wide
- Where
config lines 5 and 27src/filesystem/README.md:206-208src/filesystem/README.md:215src/git/README.md:45, 52, 59, 81
- Observed
- The filesystem README marks write_file, edit_file and move_file as destructive. The config grants a Desktop directory plus a second one, with no read-only mount. The git server exposes commit, add, reset and checkout.
- Why it matters
- A model that can be talked into a bad edit can overwrite or move anything in the granted directories. Desktop folders tend to hold more than the task needs.
- Fix
- Grant the narrowest working directory that does the job. Use the Docker form with an ro mount for anything the model only reads. Point git at a repository you can afford to rewind, with per-call approval on.
A fetch server in the same client as local files makes a read-then-send path
- Where
config lines 20-23src/fetch/README.md:11-12
- Observed
- The fetch README carries a caution that the server can reach local and internal IP addresses. mcp-scan's cross-server-flow rule only checks whether one server's tool text names another server, so it does not model this combination, and it reported nothing here.
- Why it matters
- A web page the model reads can carry instructions. With files in reach and an outbound request tool, the page can try to talk the model into sending file contents out in a URL.
- Fix
- Decide whether this client needs both. If it does, require approval on every fetch call, restrict outbound hosts at the network layer, and keep secrets out of the granted directories.
The everything server is a client test harness
- Where
config lines 12-15src/everything/README.md:10
- Observed
- Its own README says it is not intended to be useful and exists for people building MCP clients.
- Why it matters
- It adds tools, resources and sampling surface to a client that gets nothing back for it.
- Fix
- Remove it from any config that is not a client test bench.
Fix order
| Step | Effort |
|---|---|
| 1. Pin all seven servers to reviewed versions | About 15 minutes |
| 2. Remove the everything server | About 1 minute |
| 3. Narrow the filesystem and git grants, add the read-only mount | About 30 minutes |
| 4. Decide on fetch beside local files | A team decision, then 15 minutes |
| 5. Re-run the scan and compare | About 5 minutes |
After the re-run in step 5 the answer becomes proceed, with the fetch decision recorded.
What a paid review checks by hand
A scanner reads config text. These need a person with access to the real setup.
- Your real config files, not the documented placeholders: the actual directories, repositories and env values, and who can edit the file.
- The live tool list and descriptions each server returns when it starts. Tool-description injection hides there, and a config scan never sees it.
- Client approval settings: which tool calls run without a prompt.
- What else the model can reach in the same session: tokens in the shell environment, other connectors, credentials in granted folders.
- The host: network egress rules, container boundaries, and which OS account the client runs under.
- Who publishes each package, and whether you accept that publisher in your supply chain.
MCP Risk Review: $3,000, 48 hours from access. Ends in a written go, fix or escalate decision. If it finds something to fix, remediation is a separate scoped engagement.
- $3,000
- 48 hours from access
Appendix: the config we scanned
{ "mcpServers": { "filesystem": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/username/Desktop", "/path/to/other/allowed/dir"] }, "memory": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-memory"], "env": { "MEMORY_FILE_PATH": "/path/to/custom/memory.jsonl" } }, "everything": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-everything"] }, "sequential-thinking": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-sequential-thinking"] }, "fetch": { "command": "uvx", "args": ["mcp-server-fetch"], "env": { "PYTHONIOENCODING": "utf-8" } }, "git": { "command": "uvx", "args": ["mcp-server-git", "--repository", "path/to/git/repo"] }, "time": { "command": "uvx", "args": ["mcp-server-time"] }, "mcp-docs": { "type": "http", "url": "https://modelcontextprotocol.io/mcp" } }}
npx mcp-scan@2.0.13 scan --config claude_desktop_config.json