Validate an MCP config
before it runs.

What the MCP config validator checks

• A valid mcpServers or VS Code servers wrapper
• Codex [mcp_servers.name] TOML tables
• Exactly one transport per server: local command or remote url
• Array and object types for arguments and environment variables
• HTTP endpoints that are not encrypted
• Hard-coded API keys, access tokens and bearer credentials
• Legacy SSE and client-specific portability issues

Does this prove an MCP server is safe?

No. Configuration validation is a preflight check, not a source-code security audit. A syntactically valid server may still execute unsafe code, request excessive access, or change after installation. Review the server’s source, publisher and requested capabilities before granting it sensitive data.

Why local validation matters

MCP configs frequently contain paths, internal URLs and credential references. The validator runs as browser JavaScript and does not send pasted content to a backend.