MCP Config Privacy Scanner - Claude Code Hook

#!/usr/bin/env bash
set -u

# Claude Code PreToolUse hook for Write/Edit/MultiEdit. It scans proposed
# changes to MCP configuration files before they reach disk. It reads only the
# pending tool input and never contacts an MCP server.

if ! command -v jq >/dev/null 2>&1; then
  exit 0
fi

input=$(cat)
tool_name=$(printf '%s' "$input" | jq -r '.tool_name // .toolName // empty')

case "$tool_name" in
  Write|Edit|MultiEdit|write|edit|multiedit) ;;
  *) exit 0 ;;
esac

file_path=$(printf '%s' "$input" | jq -r '.tool_input.file_path // .toolInput.file_path // .tool_input.path // .toolInput.path // empty')
content=$(printf '%s' "$input" | jq -r '
  [ .tool_input.content,
    .toolInput.content,
    .tool_input.new_string,
    .toolInput.new_string,
    (.tool_input.edits[]?.new_string),
    (.toolInput.edits[]?.new_string) ]
  | map(select(. != null)) | join("\n")
')
edit_new_content=$(printf '%s' "$input" | jq -r '
  [ .tool_input.new_string,
    .toolInput.new_string,
    (.tool_input.edits[]?.new_string),
    (.toolInput.edits[]?.new_string) ]
  | map(select(. != null)) | join("\n")
')

if [ -z "$content" ]; then
  exit 0
fi

is_mcp_target=0
case "$file_path" in
  .mcp.json|*/.mcp.json|mcp.json|*/mcp.json|*/managed-mcp.json|*claude_desktop_config.json|*/.vscode/mcp.json|*/.cursor/mcp.json|*/.windsurf/mcp_config.json)
    is_mcp_target=1
    ;;
esac

if printf '%s\n' "$content" | grep -Eq '"mcpServers"[[:space:]]*:'; then
  is_mcp_target=1
fi

if [ "$is_mcp_target" -ne 1 ]; then
  exit 0
fi

if [ -n "${MCP_CONFIG_PRIVACY_ALLOWLIST:-}" ]; then
  if printf '%s\n%s\n' "$file_path" "$content" | grep -Eq -- "$MCP_CONFIG_PRIVACY_ALLOWLIST"; then
    exit 0
  fi
fi

findings=""
add_finding() {
  findings="${findings}${1}"$'\n'
}

if printf '%s' "$content" | jq -e . >/dev/null 2>&1; then
  inline_keys=$(printf '%s' "$content" | jq -r '
    .. | objects
    | [(.env? // {}), (.headers? // {})]
    | .[]
    | objects
    | to_entries[]?
    | select(
        (.key | test("(TOKEN|KEY|SECRET|PASSWORD|PAT|COOKIE|SESSION|PRIVATE|CREDENTIAL|AUTHORIZATION)"; "i"))
        and (.value | type == "string")
        and ((.value | test("^(Bearer\\s+)?(\\$[A-Za-z_][A-Za-z0-9_]*|\\$\\{[A-Za-z_][A-Za-z0-9_]*\\})$|^<[^>]+>$|^$|^REPLACE_|^your-|^example"; "i")) | not)
      )
    | .key
  ' 2>/dev/null | sort -u)

  if [ -n "$inline_keys" ]; then
    add_finding "inline credential value in env or headers"
  fi

  credential_urls=$(printf '%s' "$content" | jq -r '
    .. | strings
    | select(test("https?://[^[:space:]\"<>]+[?&](access_token|api_key|token|password|client_secret)="; "i"))
  ' 2>/dev/null | head -n 1)

  if [ -n "$credential_urls" ]; then
    add_finding "credential-bearing URL in MCP config"
  fi

  broad_roots=$(printf '%s' "$content" | jq -r '
    .. | objects
    | select((.command? // "" | tostring | test("filesystem|server-filesystem|@modelcontextprotocol/server-filesystem"; "i")))
    | [.args[]?]
    | map(tostring)[]
    | select(test("^(~|/|/Users|/home|/root|[A-Za-z]:\\\\Users)(/)?$"))
  ' 2>/dev/null | head -n 1)

  if [ -n "$broad_roots" ]; then
    add_finding "broad filesystem root exposed to filesystem MCP server"
  fi
fi

secret_name_re='(TOKEN|KEY|SECRET|PASSWORD|PAT|COOKIE|SESSION|PRIVATE|CREDENTIAL|AUTHORIZATION)'
literal_secret_re="\"[A-Za-z0-9_ -]*${secret_name_re}[A-Za-z0-9_ -]*\"[[:space:]]*:[[:space:]]*\"(Bearer[[:space:]]+)?[^\"\\$<{][^\"]{8,}\""
default_expansion_secret_re="\"[A-Za-z0-9_ -]*${secret_name_re}[A-Za-z0-9_ -]*\"[[:space:]]*:[[:space:]]*\"(Bearer[[:space:]]+)?\\$\{[A-Za-z_][A-Za-z0-9_]*:-[^}\"]{8,}\}\""
credential_url_re='https?://[^[:space:]"<>]+[?&](access_token|api_key|token|password|client_secret)='
bare_secret_value_re='^"?(Bearer[[:space:]]+)?(sk-[A-Za-z0-9_-]{12,}|[A-Za-z0-9_./+=-]{24,})"?$'
broad_root_value_re='^"?(~|/|/Users|/home|/root|[A-Za-z]:\\Users)/?"?$'

if [ -n "$edit_new_content" ]; then
  if printf '%s\n' "$edit_new_content" | grep -Eq -- "$bare_secret_value_re"; then
    add_finding "inline credential value in env or headers"
  fi

  if printf '%s\n' "$edit_new_content" | grep -Eq -- "$broad_root_value_re"; then
    add_finding "broad filesystem root exposed to filesystem MCP server"
  fi
fi

if printf '%s\n' "$content" | grep -Eiq -- "$literal_secret_re"; then
  add_finding "inline credential value in env or headers"
fi

if printf '%s\n' "$content" | grep -Eiq -- "$default_expansion_secret_re"; then
  add_finding "inline credential value in env or headers"
fi

if printf '%s\n' "$content" | grep -Eiq -- "$credential_url_re"; then
  add_finding "credential-bearing URL in MCP config"
fi

if printf '%s\n' "$content" | grep -Eiq 'server-filesystem|@modelcontextprotocol/server-filesystem|filesystem'; then
  if printf '%s\n' "$content" | grep -Eq '"(~|/|/Users|/home|/root|[A-Za-z]:\\Users)"'; then
    add_finding "broad filesystem root exposed to filesystem MCP server"
  fi
fi

if [ -z "$findings" ]; then
  exit 0
fi

echo "MCP config privacy scanner: risky MCP configuration edit detected." >&2
printf '%s' "$findings" | sort -u | while IFS= read -r finding; do
  [ -n "$finding" ] || continue
  echo "  - $finding" >&2
done
echo "Use environment-variable expansion, remove credential query strings, or narrow filesystem roots before writing the config." >&2
echo "Set MCP_CONFIG_PRIVACY_MODE=advisory to warn without blocking, or MCP_CONFIG_PRIVACY_ALLOWLIST for a reviewed local exception." >&2

if [ "${MCP_CONFIG_PRIVACY_MODE:-block}" = "advisory" ]; then
  exit 0
fi

exit 2