Agent-access-review – an access review for AI agents' MCP configs

Agent-access-review is a Python tool that discovers AI agents and MCP servers from Claude Desktop, Cursor and VS Code configs and from agents.yaml manifests, classifies what each can read, write, execute and send, and tests that access against 14 controls mapped to NIST 800-53, SOC 2, NIST AI RMF and the OWASP Top 10 for LLM Applications. It redacts secrets before hashing evidence with SHA-256 and exports a reviewer packet, a Keep/Modify/Revoke CSV and OSCAL 1.1.2 assessment results. A bundled demo reviews five example agents, and the author reports that copying MCP configs from official READMEs yielded 8 of 9 unpinned and 7 of 9 with unreviewed write/send/execute access.