MSCC maps how MCP servers, agent skills, and memory files chain into exposure paths — not a scanner that finds bad objects one at a time.
Highlights since 0.1.0
- Cross-surface exposure graph (
mscc graph) — a poisoned skill/memory reaching a sensitive MCP server and an egress, with 0 false positives across 370 real installed skills. - Graded exposure paths (
mscc exposure) — source → sensitive → egress chains scored 0–100 by approval gating, capability breadth, source trust, and egress reach. - Machine audit (
mscc surface) — MCP configs, skills, memory across 12 agent clients; now also detects DXT extensions and warns on remote OAuth connectors it cannot statically inspect. - Drift / rug-pull detection (
mscc lock/verify), policy-as-code (mscc policy), and OWASP MCP Top 10 / ASI06 mapping (mscc frameworks). - ~100-entry capability catalog, toxic-flow detection for skills/memory, and multi-format reports (JSON, SARIF, Markdown, HTML, PDF, SVG).
Privacy
Runs entirely on your machine. No network calls of its own, no telemetry, nothing leaves the box.
Install: pip install mscc · Audit now: uvx mscc surface
Full detail in CHANGELOG.md.