Know what your AI agents can reach.
Your team connects Claude, Codex, Cursor and VS Code to databases, GitHub and file systems through MCP servers, usually by pasting config from the internet, and add plugins, skills and extensions on top. Permiscope keeps the list of every one of them, flags the risky ones, and tells you when something changes.
Read-only scans · secrets redacted on the device · data stored in the EU
- HIGHCredential embedded in MCP configurationgithub · Claude Code · anna-mbp
- HIGHDownload piped into an interpretertools · Cursor · marek-mbp
- MEDPackage version not pinnedpostgres · VS Code · ci: acme/api
- MEDFilesystem server with a broad rootfiles · Claude Desktop · ola-mbp
Nobody has the list
MCP servers live in a dozen config files per laptop. IT can't see them; developers forget them.
Secrets in plain text
Setup guides put API keys straight into the config, where every agent and backup can read them.
Code that changes itself
Unpinned npx servers fetch whatever is newest at every start: a supply-chain risk on every laptop.
One command per computer. Then it runs itself.
No agents in your traffic, no proxies, nothing to configure per developer.
1. Install
Send your team an install link, run one command on macOS, Windows or Linux, or push it through Jamf, Kandji, Mosyle or Intune. It brings its own runtime and keeps its token encrypted.
2. Scan daily
Every morning and at login it reads the AI clients' config files, including projects they have opened, redacts secrets and uploads the result.
3. Review and act
See every server and finding in one place, approve a baseline, and get alerted by email, Slack or Teams when something drifts.
The mistakes that actually show up in MCP configs
Deterministic rules on declared configuration. Every finding shows its evidence and a fix, never the secret itself.
Agents that approve their own actions
Codex without approval or sandbox, Claude Code skipping permission prompts or allowing any shell command, VS Code auto-approving every tool.
Repositories that decide what runs
Project settings that start every MCP server or run hook commands for anyone who opens the repository.
Credentials pasted into config
API keys and tokens written inline in env, headers, arguments or URLs. The kind is recognised on the device (a classic GitHub token, a long-term AWS key, a live Stripe key), never the value.
Download piped into a shell
Servers started through shell strings, including the classic curl … | sh pattern.
Containers with host access
Docker-based servers running privileged, on the host network, or with the Docker socket mounted.
Malicious, lookalike or vulnerable packages
npm, PyPI and Docker Hub packages reported as malware, names one character away from a well-known server, versions with published advisories, and brand-new packages nobody uses.
Add-ons nobody approved
Claude Code plugins and marketplaces added by a repository, skills that ship scripts, and editor extensions installed from a file or reported as malicious.
Production databases within reach
Servers pointed at production database hosts or credentials, where a steered agent can read or change live data.
Code from Downloads or /tmp
Servers started from temporary or download folders, and config files any user of the machine can edit.
Unpinned packages
npx and uvx servers without a version, so every start can fetch and run different code.
Unusual package sources
Packages pulled from a non-default registry, a git URL or a tarball.
Remote servers over plain HTTP
Unencrypted connections, rated higher when credentials travel with them.
Filesystem access to everything
File servers rooted at / or the whole home folder instead of one project.
Outdated AI tools
Claude Code, Codex CLI and Gemini CLI versions with published vulnerabilities.
Covers
Claude Code, Claude Desktop (including extensions), Cursor, VS Code, Codex CLI, Gemini CLI, Windsurf, Cline, Roo Code, Continue, Zed and Amazon Q, project configs in the folders they open, and Claude Code's organization-managed settings; plus Claude Code plugins, skills and marketplaces, editor extensions in VS Code, Cursor and Windsurf, and Claude Enterprise organization settings.
From one laptop to the whole company
Inventory
Every MCP server across devices and repositories (client, transport, package, version and origin), and every plugin, skill and editor extension around them.
Drift detection
Approve what's normal once. New, changed or removed servers become a change to review, with a field-by-field diff.
Triage with expiry
Assign findings, comment, mark false positives, or accept a risk until a date. Expired exceptions reopen on their own.
Alerts where you work
Email, Slack or Microsoft Teams, filtered by severity and de-duplicated, so the same issue doesn't ping you twice.
Pull request checks
A GitHub Actions step annotates risky MCP config on the exact line of the pull request and can fail the check. Set up in a few clicks.
Reports
A one-page security report as PDF for management or auditors, and CSV exports of findings.
Your own policy
Allow or deny MCP servers by package, host or command, and plugins, marketplaces or extensions by name. Anything off-policy becomes a finding.
Claude Enterprise
Connect a read-only Compliance key to check your Claude organization's settings and get alerted when connectors, plugins or tool policies change.
Fleet rollout
One MDM script for Jamf, Kandji, Mosyle or Intune installs a signed, root-owned agent that users cannot switch off; or send an install link to everyone else.
A security tool that behaves like one
Passive by design
Scans only read configuration files. They never start an MCP server, install a package, or call a tool.
Secrets stay on the laptop
Values of env variables, headers and credential-like arguments are redacted on the device, and redacted again on the server.
Isolated per organization
Every tenant's data is separated by row-level security in the database, not just by application code.
Stored in the EU
Your organization's data is stored in Frankfurt. Fonts and assets are self-hosted: no third-party trackers.
Least privilege everywhere
Per-device tokens bound to one machine, roles from viewer to owner, two-factor sign-in, and an audit log.
Verified updates
Managed Macs run only the Apple-signed, notarized Permiscope binary and never accept an older version; every other install checks SHA-256 checksums before anything runs.
Find out what your agents can reach today.
Create a workspace, install on your own computer, and see the first results in a minute.
Get started