You'd reach for this when you're adding third-party MCP servers to your setup and want a security check first. It audits other servers and returns one of four verdicts: safe, caution, unsafe, or inconclusive. Think of it as a linter for MCP integrations. The source doesn't specify what security criteria it checks, but the idea is straightforward: point it at an MCP server before you trust it with your data or system access. Useful if you're working in an environment where vetting dependencies matters or you're pulling in community-built servers you haven't reviewed yourself.
MCEPTION_DATA_DIRWhere audit reports and rug-pull baselines live. Defaults to ~/.mception.
MCEPTION_OFFLINEdefault: 0Set to 1 to block outbound HTTP (OSV, registry signals, phantom-repo probes).
MCEPTION_INTROSPECT_TIMEOUTdefault: 60Per-target timeout in seconds for the fetcher + engine pipeline.
MCEPTION_ENABLE_LLM_JUDGEdefault: 0Set to 1 to enable advisory LLM-assisted classification via MCP sampling. No API key needed.
com.exploit-intel/eip-mcp
dmontgomery40/pentest-mcp
pantheon-security/notebooklm-mcp-secure
cyanheads/pentest-mcp-server
io.github.akhilucky/ai-firewall-mcp