Find the MCP servers on your machine

Run it

npx protocolprobe-discover                      # user-level configs and this folder's project configs
npx protocolprobe-discover --dir ../app --dir .   # project configs in these folders too
npx protocolprobe-discover --json                 # the same fields, machine-readable
npx protocolprobe-discover --help

Needs Node.js 18 or newer. It is a read-only inventory: it does not start, connect to, or test any server.

What it reads

• Claude Desktop: claude_desktop_config.json (Windows and macOS) and, for servers it actually started, the names of the log files in its logs folder.
• Claude Code: ~/.claude.json (user and local scope) and .mcp.json in the folders you pass.
• Cursor: ~/.cursor/mcp.json and .cursor/mcp.json in the folders you pass.
• VS Code and Copilot: the user mcp.json (all profiles, VS Code and Insiders), ~/.copilot/mcp-config.json and .vscode/mcp.json in the folders you pass.

What it shows, and what it never shows

• Shown: server name, which tool and file it is configured in, transport, the command's program name, the package a known launcher starts (npx, uvx, docker, …), a remote server's address with its host and path shortened, counts of arguments, environment variables and headers, and the names of environment variables written in the usual upper-case form.
• Never shown: environment or header values, command arguments, URL credentials, query strings and fragments, URL path parts other than generic words (mcp, sse, v1, …), hosts that the registry does not list (shortened to their last two labels), and anything that looks like a credential. A value that is not known to be safe is counted, not printed.
• The rule is conservative, not perfect: the package's README lists the cases that can still get through (for example a credential used as a short, whole domain name). Check the output before you paste it somewhere public.

It sends nothing

The command makes no network request, starts no other program, runs no install script and has no dependencies. The package contains its full, readable source, and a test checks that its code imports nothing beyond Node's file, path, OS, compression and URL helpers. The registry lookup below is a file inside the package, not a request.

Matching against the registry

Each recognised package (npm, PyPI, container image) and each remote address is looked up in a snapshot of the official MCP registry shipped with the command: 38,977 servers, as of 2026-10-04, latest version of each. A match prints the registry name and the link to that server's page here, where we show what we checked and what we did not. Three outcomes: listed; shared by N registry entries (several entries use the same package or address, so we do not guess); or not found.

• In this snapshot 97.2% of package names (14,720 of 15,140) and 99.8% of remote addresses (24,358 of 24,401) belong to exactly one registry server.
• “Not found” says nothing about safety. The server may be newer than the snapshot, unpublished, or not a registry server. Several widely used reference servers (for example @modelcontextprotocol/server-filesystem) are not registry packages and show as not found.
• The command warns when its snapshot is more than 60 days old. A listed server's page is a set of checked facts with their dates, not a safety rating.

Limits

• Only the tools and file locations above. Not covered: other clients, company-managed configuration files, plugin-provided servers, relocated configuration folders, servers started without a configuration file, and the address inside most other launcher commands (only npx mcp-remote <address> is read).
• Project folders are read only when you pass them (default: the current folder); it does not search your disk.
• “Started” evidence exists only for Claude Desktop, and its logs persist, so a listed name was started at some point, not necessarily now.
• Run and tested on Windows. The macOS and Linux file locations are checked by tests that assert the paths, not by running there.
• The configuration locations come from each vendor's documentation as read on 2026-10-10 and can change.

Licence and questions

Free to use under the ISC licence, provided as it is without warranty (see the terms). Questions or a case it got wrong: hello@protocolprobe.com.