Sefism is free for learners. We are here to help you grow, one step at a time.Join for free
Sefism.
Security

Team-Wide MCP Configuration Inventory and Least-Privilege Auditor

Developers now plug MCP servers into Claude, Cursor, VS Code and other AI tools with a few lines of config, often with a full-access GitHub token, a whole home folder as the filesystem root, and an unpinned package run with npx. Build an auditor that collects MCP configurations across a team's machines, inventories every server and credential, scores each against least-privilege rules, and proposes a tighter config.

Topics
Difficulty

Intermediate

A small team, or one strong student willing to learn something new.
Effort

1 semester · 2 students

Deliverables

7 to ship

3 optional extras

Suggested stack

Python or GoMCP Python SDKSQLitePostgreSQLFastAPIReact
A suggestion, not a requirement. Swap anything for what you already know.

What you should ship

  • A small CLI agent that finds MCP config files for common AI clients on macOS, Windows and Linux and reports servers, commands, arguments and env variable names, never secret values
  • Rules that flag risky patterns: filesystem roots covering a whole home or drive, tokens with broad scopes, unpinned package versions, unknown registries, shell or code-execution tools, and unauthenticated remote servers
  • Token scope checks for at least GitHub and one cloud provider, using the provider's own API to read scopes for a token the developer owns
  • Tool description pinning: record a hash of each server's tool list and alert when it changes
  • A team dashboard: which servers are in use, on how many machines, and the riskiest configurations
  • A suggested least-privilege rewrite for each flagged config that the developer can accept
  • An evaluation on a lab of at least 15 deliberately varied configurations you create

If you have time left

  • An allow list of approved servers and versions that the agent enforces
  • Export of findings as SARIF for GitHub code scanning
  • Checks for project-level MCP configs committed into repositories

The problem: MCP made it easy to give an AI tool the keys

The Model Context Protocol lets an AI assistant use tools: read files, query a database, open pull requests. Adding a server is a few lines of JSON. The fastest way to make it work is also the most dangerous: point the filesystem server at your whole home folder, paste a classic GitHub token with every scope, and run the latest version of a package straight from npm. Multiply that by every developer on a team and nobody knows what an AI tool could touch if it were tricked.

Invariant Labs, an ETH Zurich spin-off later acquired by Snyk, documented "tool poisoning" in 2025: malicious instructions hidden in tool descriptions, and "rug pulls" where a server silently changes its tools after you trust it. The OWASP Top 10 for Agentic Applications, published in December 2025, puts identity and privilege abuse among the top risks.

What already exists and the gap

  • mcp-scan (now part of Snyk's agent scanning) checks MCP servers for prompt injection in tool descriptions, tool poisoning and rug pulls, with tool pinning.
  • MCP Inspector helps a developer test a single server.
  • Secret scanners find tokens committed to Git, not tokens sitting in a local client config.

The gap is the permissions side across a whole team: an inventory of which servers run where, what each credential can actually do, how wide each filesystem root is, whether versions are pinned, and a concrete tighter config to replace the risky one.

Inspiration

Endpoint and cloud security already work this way: inventory first, then least privilege. Your project applies that habit to a new kind of software that most security teams have not inventoried yet.

What you build

  • A local agent that finds config files, parses them and sends a privacy-safe summary (names, commands, scopes, root paths, never secret values).
  • A rules engine with clear, documented checks and severity.
  • A dashboard for a team lead and a suggested fix per machine.

The technically interesting part

  • Knowing what a token can do without stealing it. Read scopes using the provider's own token introspection, run locally on the developer's machine, and send only the scope list.
  • Client differences. Each AI client stores config in a different place and format, and project-level configs override user-level ones.
  • Rug pull detection. Start each server in a sandbox, list its tools, hash the descriptions, and compare on every run.

How you will evaluate it

  • Detection of every planted risky pattern in your lab of configurations.
  • False positives on safe, well-scoped configurations.
  • A short study with three or four developers (classmates are fine): do they accept the suggested fix, and does their setup still work afterwards?

Path to a product

Companies adopting AI coding tools need to answer "what can these agents reach?" for audits and customers. An agent plus dashboard sold per developer seat, or an open source agent with a hosted team view, fits that need.

Scope warning

Never collect secret values, only metadata, and make that visible in the agent's output. Test with tokens and accounts you own. Do not try to cover every AI client: three popular ones is plenty.

Learn what you need on Sefism

Get help with this idea

The risk is a rules list that is either too vague to act on or too strict to keep using. Tauseef can help you pick the clients, design the rules and set up a lab that shows the auditor working. If you are new here, create a free account first.

Ideas and guidance, not finished projects

These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.

Not sure this one fits you?

I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.

Discuss this idea
Work with me

Stuck on something specific?

Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.

Book a free sessionSee all services

Follow along

New writing, resources and project ideas land here first.