MCP Server Discovery & Governance Scanner
AI coding assistants routinely configure MCP servers with exposed credentials and unaudited remote connections, but there's been no standard way to discover or govern them. Spyglass closes that visibility gap — scanning configs across 8+ AI tools, flagging security risks, and feeding findings into enforcement policies.
Spyglass is Tier 2 of a three-tier framework for MCP server governance. Discovery feeds enforcement, enforcement feeds fleet-wide visibility.
Execution-layer enforcement via Delinea Privilege Manager. Blocks tunnel service binaries, audits MCP runtimes, requires approval for remote connections.
Application-layer discovery and audit. Scans MCP configs, flags credentials, detects tunnels and remote endpoints, reports findings as structured JSON.
Fleet-wide governance dashboard. Aggregate scan results across endpoints for organization-wide MCP posture visibility. (Roadmap)
Spyglass runs three analyzers against every discovered MCP server config: credential exposure, remote connections, and runtime inventory. Credential values are never stored in findings or output.
| Finding | Severity |
|---|---|
| Env key name contains PASSWORD / SECRET / TOKEN / KEY / API_KEY / CREDENTIAL with plaintext string value | CRITICAL |
| Unknown plaintext env value (not a known non-secret, not a variable reference) | HIGH |
Inline credential flags in args: --password=, --token=, --secret=, --api-key= | HIGH |
Deferred environment variable reference (${ENV_VAR} or $ENV_VAR) | LOW |
VS Code input prompt variable (${input:ID}) | INFO |
| Finding | Severity |
|---|---|
Tunnel services: *.ngrok.io, *.ngrok-free.app, *.trycloudflare.com, *.loca.lt, *.bore.pub | HIGH |
Cloud endpoints: AWS (*.amazonaws.com), Azure (*.azurewebsites.net), GCP (*.run.app) | MEDIUM |
| Any other HTTP/HTTPS URL in command arguments | MEDIUM |
| Non-localhost IP addresses in arguments | MEDIUM |
Localhost patterns (127.0.0.1, 0.0.0.0, [::1]) | Safe — ignored |
Every server is profiled for runtime type, package, transport, source tool, and environment key names. Supports: node, npx, python, uvx, docker, deno, bun. Detects stdio vs SSE transport automatically from args and config fields.
Scans global and project-level config files across all major AI coding assistants. Cross-platform: macOS, Windows, and Linux.
Parses all formats used by AI tool MCP configurations, including non-standard variants.
Auto-detects root key structure (mcpServers, servers, or flat layout). Walks project directories up to 3 levels deep, skipping .git, .venv, node_modules, and other VCS/build dirs.
Send scan summaries to your team's collaboration platform after every scan. Includes hostname, OS, server count, findings by severity, and top 5 critical/high findings.
Block Kit formatted messages
Adaptive Card via Incoming Webhook
Markdown formatted summary
Use severity thresholds to fail builds when risky MCP configs are detected. Exit code 1 when findings meet or exceed the threshold.
Spyglass can run as an MCP server itself, exposing a scan_configs tool that AI assistants can call directly. Query your MCP posture from inside Claude, Claude Code, or any MCP-compatible client.
Exposed tool: scan_configs — accepts optional project_roots, extra_paths, and exclude_paths parameters. Returns the full scan result as structured JSON with servers, findings, and summary.