flintai scan's whitebox read of agent code is excellent, and eval covers runtime behaviour — together that's most of the picture. The piece we'd love to see it reach is the connective tissue in between: an agent's declared capabilities.
Ask: teach flintai scan to statically analyse MCP server configurations (including the mcpServers block of claude_desktop_config.json) and agent manifests, flagging patterns such as:
- Over-broad grants — a filesystem server scoped to
/ or $HOME rather than a single working directory.
- Execution surfaces — tools that can
exec/eval/spawn, inherited by any connected agent with no human in the loop by default.
- Secrets in config — API keys sitting in an
env block: unrotatable, and readable by anyone with the file.
- Remote MCP servers with no declared authentication.
- Manifests that declare no identity, scope, delegation, or approval boundary.
Why it matters. Increasingly, an agent's real blast radius isn't in its Python — it's in what it's allowed to reach. The MCP config is where "read one file" quietly becomes "read the entire home directory," and it's the part that most often ships unreviewed. It's a natural extension of the whitebox philosophy: scan already reads what the agent is; this reads what it's been given. And it pairs beautifully with eval — static over-privilege findings tell you exactly where to aim the runtime red-team.*
Filed with genuine admiration from the KXCO team (kxco.ai) — building in the same neighbourhood (post-quantum security + AI trust) and rooting for FlintAI.
flintai scan's whitebox read of agent code is excellent, andevalcovers runtime behaviour — together that's most of the picture. The piece we'd love to see it reach is the connective tissue in between: an agent's declared capabilities.Ask: teach
flintai scanto statically analyse MCP server configurations (including themcpServersblock ofclaude_desktop_config.json) and agent manifests, flagging patterns such as:/or$HOMErather than a single working directory.exec/eval/spawn, inherited by any connected agent with no human in the loop by default.envblock: unrotatable, and readable by anyone with the file.Why it matters. Increasingly, an agent's real blast radius isn't in its Python — it's in what it's allowed to reach. The MCP config is where "read one file" quietly becomes "read the entire home directory," and it's the part that most often ships unreviewed. It's a natural extension of the whitebox philosophy:
scanalready reads what the agent is; this reads what it's been given. And it pairs beautifully witheval— static over-privilege findings tell you exactly where to aim the runtime red-team.*Filed with genuine admiration from the KXCO team (kxco.ai) — building in the same neighbourhood (post-quantum security + AI trust) and rooting for FlintAI.