Which of your MCP tools can spend money, delete data or email people?

One command reads the MCP servers in your Claude Desktop, Cursor or Claude Code config, asks each one for its tools, and lists the ones that act on the real world. It never calls a tool.

# every server in your MCP client configs
pip install agentraas
agentraas scan

# or one server, by its command
agentraas scan -- npx -y @modelcontextprotocol/server-github

What you get

Real output for the official GitHub MCP server:

@modelcontextprotocol/server-github  (npx -y @modelcontextprotocol/server-github)
  26 tools: 1 high risk, 11 write, 14 read-only
    HIGH    sends      add_issue_comment  (name: comment)
    MEDIUM  writes     create_branch  (name: create)
    MEDIUM  writes     create_issue  (name: create)
    MEDIUM  writes     create_pull_request  (name: create)
    MEDIUM  writes     merge_pull_request  (name: merge)
    MEDIUM  writes     push_files  (name: push)
    ...
  Fix duplicates and get an audit log: agentraas wrap -- npx -y @modelcontextprotocol/server-github

How tools are sorted

The sorting reads each tool's MCP annotations (readOnlyHint, destructiveHint) and the words in its name. It can be wrong for a tool with an unusual name, so treat the list as a starting point for review, not a verdict. Remote (URL) servers are listed but not scanned yet.

Then fix what it found

In CI

--fail-on high exits with 1 when a high-risk tool shows up, so a new server or a server update that adds one fails the build until someone has looked. --json prints the result for other tools.

pip install agentraas
agentraas scan --config .mcp.json --fail-on high

Or the GitHub Action, which also writes the result to the job summary:

- uses: actions/setup-python@v5
  with: { python-version: "3.12" }
- uses: sumedhchatse/agentraas/src/scan-action@main
  with:
    config: .mcp.json            # optional: command, fail-on (high, medium, none), timeout

The scan starts each server with the command and environment from your config, the same way your MCP client does. Scanning a config means running the commands in it, so only scan configs you trust.