aspex mcp

Let your agent ask Aspex before it changes its own configuration: a read-only MCP server.

claude mcp add aspex -- aspex-scan mcp --no-exec

{ "mcpServers": { "aspex": { "command": "aspex-scan", "args": ["mcp", "--no-exec"] } } }

aspex-scan mcp serves Aspex over the Model Context Protocol on stdin/stdout. The point is a workflow like this:

Agent:  I want to add a filesystem server with access to /.
        → aspex_security_impact({ mcp_json: <proposed .mcp.json> })

Aspex:  verdict: introduces a CRITICAL attack path
        blast_radius_before: MEDIUM  blast_radius_after: HIGH
        attack_paths_added: [AP001 filesystem + browser: sensitive data exfiltration, ...]
        changes: FILESYSTEM SCOPE EXPANDED, credential directories newly reachable, ...

Aspex does not block the edit. It makes the consequence visible before the edit, to the thing about to make it.

Tools

Tool	Returns
aspex_security_impact	drift between the current environment and a proposed .mcp.json (plus optional .claude/settings.json hooks): verdict, blast radius before/after, security-relevant changes, attack paths added and removed. The proposal is analyzed statically and never launched. Existing user-level servers are included so compositions with them are visible.
aspex_explain	the deterministic answer to a security question (see explain)
aspex_scan	agents, servers with capabilities and scope, hook and skill counts, blast radius with reasons, attack path counts
aspex_get_capabilities	every server’s capabilities, roots, scope, egress class, agent-state writes
aspex_get_attack_paths	AP001-AP006 with evidence, impact, remediation
aspex_verify	drift against a lockfile (.lock or .json paths only)

Read-only by construction

There are no write, exec, fix or configuration tools. The server cannot modify files, run commands, or change Aspex’s own policy, lockfile or baseline. aspex_verify reads only lockfiles. The environment is computed once per process and cached; restart the server to rescan.

The tool list is fixed in code and covered by a test that fails if a tool name ever looks like a write or exec action.