mcpgawk — audit your MCP servers, from your editor

See every MCP server configured across your AI tools, grouped by the tool it lives in, with what each one can do to you and what it costs your context window.

Local-first. The extension runs the mcpgawk CLI on your machine and renders what it returns. Nothing about your servers, tools or credentials is uploaded anywhere.

Requirements

The engine is a separate CLI:

pipx install mcpgawk      # or: pip install mcpgawk

If it lives somewhere unusual (a virtualenv, a pyenv shim), set mcpgawk.path in settings.

What you get

• A panel grouped by tool — Claude Code, Cursor, Codex, Claude Desktop (including extensions), Kiro, Gemini CLI. A server configured in two tools is scanned once and listed under both, because removing it from one leaves it running in the other.
• Honest states — REVIEW / INCOMPLETE / CLEAN for servers we measured; AUTH, UNREACHABLE, SKIPPED for ones we could not; NOT-SCANNABLE for account-hosted connectors that run outside your machine and cannot be inspected at all. Nothing we failed to see is hidden.
• Sign in from the list — one click per server that needs credentials; the sign-in runs in a visible terminal and opens your system browser.
• Local servers are never launched silently. Scanning a stdio server runs its code, so it happens only when you explicitly ask, with the consequence stated.

Which editors

One build covers the VS Code family, which all share this extension API: VS Code · Cursor · Windsurf · Kiro · Antigravity.

Not covered: JetBrains IDEs (IntelliJ Platform, a separate plugin ecosystem) and Zed (Rust/WASM extensions). Those need their own builds — the CLI works fine in all of them today.

Publishing (maintainers)

The extension is a normal VSIX. Publish to both registries — the VS Code Marketplace does not serve Cursor/Windsurf/Kiro, which pull from Open VSX:

pnpm --filter mcpgawk build
npx @vscode/vsce package          # -> mcpgawk-<version>.vsix
npx @vscode/vsce publish          # VS Code Marketplace  (needs a publisher PAT)
npx ovsx publish *.vsix           # Open VSX             (needs an OVSX token)

Both are OUTWARD publishing steps and are deliberately left to a human.

Design note

The extension contains no scanning and no verdict logic. It calls mcpgawk scan --fleet-json and renders the rows the engine computes — the same rows the terminal view prints. Re-deriving "is this server clean?" in TypeScript would create a second definition of the verdict across a language boundary, where no test in either language would notice the two drifting apart. A canary test in the Python suite asserts the extension's state list, schema pin and icon map still match the engine.