AI MCP

Overview

Evidence: AI MCP
Description: Extract MCP server definitions and execution surface from AI tool configs
Category: AI
Platform: macos
Short Name: aimcp
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

Background

Model Context Protocol (MCP) servers are the execution bridge between AI agents and external systems. Configured servers can launch local commands, expose environment variables, or connect to remote endpoints.

Data Collected

This collector gathers structured data about MCP servers, including server name, launch command and arguments, environment-variable names, transport, URL host, and risk flags.

Collection Method

This collector scans claude_desktop_config.json, .mcp.json, and mcp.json in per-user and per-project scope and extracts each defined MCP server.

Forensic Value

Inventories every MCP server configured on the host. Risk flags highlight remote servers, risky launchers, broad environment exposure, and suspicious command patterns that can extend an agent’s reach.