Open-source tool reviews AI agent MCP configuration access permissions
Understand this story
Developer Mihirajmera has open-sourced the agent-access-review tool, used to scan the MCP configurations and agents.yaml of Claude Desktop, Cursor, and VS Code, identify every agent and MCP server running in the organization, determine what each can read, write, execute, and send, and test these access permissions against 12 control items. The tool generates the materials needed for auditing: reviewer sign-off forms, hashed evidence, and OSCAL assessment results mapped to NIST 800-53, SOC 2, NIST AI RMF, and the OWASP Top 10 for LLM Applications. Use requires Python 3.11+, with no cloud account, API key, or network access needed; secrets in the configuration are masked before anything is written, so the output can be shared safely. The author notes that it reviews configuration rather than runtime behavior.
AI overview based on source reports · Updated 2 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIAgent-access-review – an access review for AI agents' MCP configs
Agent-access-review is a Python tool that discovers AI agents and MCP servers from Claude Desktop, Cursor and VS Code configs and from agents.yaml manifests, classifies what each can read, write, execute and send, and tests that access against 14 controls mapped to NIST 800-53, SOC 2, NIST AI RMF and the OWASP Top 10 for LLM Applications. It redacts secrets before hashing evidence with SHA-256 and exports a reviewer packet, a Keep/Modify/Revoke CSV and OSCAL 1.1.2 assessment results. A bundled demo reviews five example agents, and the author reports that copying MCP configs from official READMEs yielded 8 of 9 unpinned and 7 of 9 with unreviewed write/send/execute access.
Activity for this story
- Current comparable activity
- 3
- Peak comparable activity
- 10Nov 13 00:00
- Change in the past 24 hours
- -50%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.