Free · no account · nothing stored unless you share

Is my MCP config safe?

Paste the file your agent reads. Every MCP server, skill, plugin and hook in it is matched to its KillerSkills verdict, and each is ranked by what it could reach if it turned hostile: the credentials you handed it, whether it runs local code, what it did in the sandbox.

File typeParsed in your browser. Secret values never leave this page.

Where the file isClaude Code: ~/.claude.json (user) or .mcp.json (project). Claude Desktop: Settings → Developer → Edit Config. Cursor: ~/.cursor/mcp.json. Windsurf: ~/.codeium/windsurf/mcp_config.json. Codex: ~/.codex/config.toml.

What leaves your browserOnly names: each server or skill name, the package it runs, a remote server's host, and the names of its env vars and headers. Values, arguments, URL paths and the file itself stay on this page. A share link stores those same names.

Do it for a whole teamOne command on every laptop and a read-only GitHub App for every repo, rescanned daily, with removal across machines. Discovery for teams →