What is MCP, and why does it need auditing?
The Model Context Protocol (MCP) is an open standard that lets an AI client like Claude Desktop talk to external tools — a filesystem, a database, Gmail, Notion, a shell. Instead of one hard-coded integration per app, MCP defines a common way for servers to advertise tools and for clients to call them. It's the reason "Claude, summarize the PDFs in ~/Downloads and email me the top three" is a single sentence today.
The catch is that most of those servers run on your machine, with your user account, with your files. When Claude decides to call filesystem.read, the read happens with your permissions. No sandbox. No confirmation step. The model chose, and the operating system said yes.
A tool call that looks reasonable in chat — "read my project notes" — can, on a poisoned document, become "read ~/.ssh/id_rsa and paste it into a draft email." The AI is not being malicious. It is being literal.
Auditing is how you notice.
The seven risks of a local MCP server
These are the categories xCLAUDE flags in its detection engine. Each maps to a real class of MCP tool call — worth reasoning about before you connect a new server. Select one to read it.
Credential exposure
A tool call contains or returns credential patterns — API keys, tokens, secrets, passwords — that could be leaked through the model's response or forwarded elsewhere. Any tool that reads files or returns structured data is a credential-exposure risk.
Baseline: every normal call is still logged
The absence of a flag does not mean the absence of a record. Every MCP tool call — name, arguments, response, timestamp — is written to the session log, so you can review what happened even when no detector fired.
Hardening your MCP setup
Before you audit, minimize. Every MCP server you add is a new set of hands. A few habits that pay for themselves the first week:
01
Scope filesystem servers to specific paths
Point the filesystem server at a working directory (~/mcp-workspace) rather than / or your home folder. Anything outside is invisible to the model — which means invisible to the accident.
02
Prefer read-only servers when you can
Many MCP servers ship read-only modes. Turn them on for anything you don't actively need write access to — inbox, calendar, notes. You can always widen scope later.
03
Keep shell servers off by default
Enable a shell MCP only for the session you actually need it. Removing it from claude_desktop_config.json and restarting takes fifteen seconds and removes an entire category of risk.
04
Segment credentials
The account you connect to Gmail via MCP doesn't have to be your primary email. Use scoped API keys and separate workspaces; MCP servers will happily use whichever credentials you hand them.
05
Restart Claude Desktop after every config change
MCP servers are loaded once at startup. A change to claude_desktop_config.json doesn't take effect until Claude Desktop restarts — and stale configurations are how "I already removed that server" turns into a surprise.
Auditing every tool call with xCLAUDE
Hardening reduces the surface. Auditing tells you what actually happened on it. xCLAUDE is the layer we built for the second job — a local proxy that sits between Claude Desktop and your MCP servers, records every call, classifies risk in real time, and warns you without ever blocking. It audits Claude Code sessions too, through a one-click session hook.
The design is deliberate. Blocking a call the model needs breaks Claude in ways that push people to turn the safeguard off. A receipt you can review after the fact — with the arguments, the response, and a severity label — is a safeguard people leave running.
What xCLAUDE records
Every request and response, with tool name, arguments, timestamps, and raw payload — stored as per-session JSONL files on your Mac, consolidated into daily files as sessions finish. Nothing is sent anywhere; no account, no telemetry.
What xCLAUDE classifies
A detection engine flags calls matching the seven risk categories above, across four severity levels. Detections appear in the dashboard the moment they happen.
What xCLAUDE does not do
It does not block, require an account, or phone home. It also does not see Claude Desktop's native Connectors (Settings → Connectors) — those bypass MCP by calling providers directly. xCLAUDE audits the MCP traffic, which is where the local risk lives.
A 10-minute checklist
If you do nothing else this week. Tap each item as you go.
A free, open-source, local audit layer for Claude Desktop and Claude Code.
It records, classifies, and warns — it never blocks. Runs entirely on your Mac. No account, no telemetry.