Skip to main content

Discover agents and MCP servers

unveilr scan

Fingerprints locally-installed coding agents and finds the MCP servers they are configured to reach.

scan is not repository scanning

unveilr scan discovers agents and MCP servers. Scanning a repository for findings is the bare invocation, unveilr <path> — see Inspect. The CLI's own help says the same thing, because the overlap is a real source of confusion.

What it looks for​

Agents — Claude Code, Claude Desktop, Cursor, GitHub Copilot. This is presence evidence only: the tool reports that an agent is installed and configured, not what it has done.

MCP servers — configured across those clients, plus project-level .mcp.json. For each server you get its identifier, transport, and the arguments it was configured with.

Credentials are never read​

This is the part worth being precise about, because a discovery tool that reads secrets is a worse problem than the one it solves.

Any credential-shaped value in a server's arguments or URL is replaced with [REDACTED] before it leaves the process. The flag or parameter name survives, because "this server holds an API key" is the useful signal; the value is not, and is stripped.

Credential values are never read, printed, logged or stored.

Interpreting the output​

A discovered server is not automatically a problem. What makes one interesting is usually its root: an MCP server rooted above the project directory can reach files the project never intended to expose, and that is visible in the configured arguments.

Two cautions the tool applies to itself:

  • Discovery is not proof of exploitability. Finding that an agent can reach something is not evidence that it has, or that an attacker could.
  • Credential discovery does not imply exfiltration. Detecting that a credential is reachable is the entire claim.

Registering servers with a control plane​

unveilr register [--all]

Optional, and only meaningful with UNVEILR_SAAS_URL and UNVEILR_API_TOKEN set. Without them the CLI stays local. See Privacy for exactly what is and is not transmitted.