We built this because we kept seeing the same thing at companies we work with: engineers install MCP servers in 30 seconds: connect Cursor to a production database, give Claude Code access to internal APIs, spin up an MCP server for Jira. And nobody on the security side knows it happened. There's no discovery mechanism. It's shadow IT, except now the "user" is an autonomous agent making tool calls on its own.

When you run `golf-scanner audit`, it scans your IDE and AI tool configs (user-level and per-project), identifies every MCP server, classifies each one by transport type, and runs ~15 security checks: command injection patterns in server args, hardcoded credentials, dangerous container configurations, script and binary permission issues, and known vulnerabilities via OSV for npm/PyPI packages. Everything is pure Go, single static binary. It produces a 0-100 risk score per server with severity-weighted findings.

The thing that motivated us to build this, and what we think the industry is getting wrong more broadly: most "AI security" tooling is actually LLM security: prompt injection detection, output filtering, guardrails on the model API layer. That protects one layer. But when someone connects Cursor to a production database via MCP, the risk isn't what the model says… it's what the agent does. The tool calls, the data access, the system connections happening downstream of the LLM. Your LLM guardrails won’t protect any of that. It's like putting a firewall on your CDN and calling your database secured. The threat model for an MCP-connected agent is closer to an unmanaged service account than a SaaS app. That's a fundamentally different security problem.

The scanner is one piece of Golf, our commercial product, an enterprise MCP control plane for managing agent tool access across your org. The platform runs the same scanner across your fleet via MDM, adds deeper checks (deep analysis of server source code for local servers, capabilities analysis for remote ones, rug-pull detection, toxic tool combinations etc.), and ties everything into a centralized inventory with access policies, PII scrubbing, and SIEM forwarding. Then you route all approved servers though our gateway to close the loop.

But if you just want to know "what MCP servers are on my machine and which ones look sketchy," that's the free tool.

brew install golf-mcp/tap/golf-scanner golf-scanner audit

I'd genuinely love to hear from enterprise folks: How are you thinking about securing MCP servers and agent tool access today? What's missing from the current tooling?