MCP Config Validator
Validate .mcp.json and claude_desktop_config.json files in your browser. Catches JSON syntax errors, schema mistakes, and hardcoded secrets before they break your AI coding assistant.
MCP Config JSON
Validation Report
About this validator:
Everything runs locally in your browser — the config never leaves your machine. Secret detection uses pattern matching for common provider formats (AWS, Google, OpenAI, Anthropic, GitHub, Slack, private keys, JWTs) and may miss custom formats; treat it as a safety net, not a guarantee.
How to Use the Tool
The MCP Config Validator checks Model Context Protocol client configuration files against the structure expected by Claude Desktop, Cursor and VS Code, plus a security pass for leaked credentials and risky launch commands.
- Locate your config file: Claude Desktop: claude_desktop_config.json. VS Code: .mcp.json in the repo root. Cursor: mcpServers inside settings.
- Paste the contents: Validation runs instantly as you type — JSON syntax, schema shape, and security checks execute in your browser.
- Fix the findings: Errors must be fixed for the client to load the config; warnings highlight risky patterns worth reviewing.
- Check the server inventory: The parsed server list confirms each entry was understood: transport type, command or URL, and environment variable names (values are never displayed).
Frequently Asked Questions (FAQ)
Which MCP config formats are supported?
Three shapes are recognized: Claude Desktop and Cursor (root key "mcpServers"), VS Code .mcp.json (root key "servers"), and a bare single-server object. The format is detected automatically and shown as a badge in the report.
Does the validator connect to my servers or send my config anywhere?
No. Parsing, schema validation and secret detection all run in JavaScript inside your browser. There are zero network calls, and env values are never rendered — only variable names appear in the server inventory.
Why does npx trigger a warning?
npx resolves and executes a package at launch time, so a typosquatted or compromised registry entry runs code on your machine with your user privileges. The warning is informational: pin exact versions, prefer scoped official packages, and review anything before it spreads through your team's configs.
The config is valid JSON but my client still fails to load it. What else can I check?
Check the file location for your specific client, that the server command exists on PATH, and the client's own logs. This validator covers the config file itself; runtime issues like missing binaries or blocked network access are outside its scope.