Capabilities
A capability is what a server can do, with evidence: the tool that grants it, or the config line (an allowed root, a package identity). Aspex classifies tools by whole tokens in their names, descriptions and schemas:create_pull_request is a GitHub channel, not HTTP egress; slack_reply_to_thread is not a REPL.
In static scans (
--no-exec) capabilities are inferred for well-known packages (the official filesystem, fetch, GitHub, GitLab, Slack, Brave, memory, Postgres and SQLite servers, browser automation, shell servers) at confidence: medium. Roots still come from your config.
Attack paths
A path is a security conclusion about a composition of capabilities, never about a single one. A shell server alone, a fetch server alone, or a home-scoped filesystem server alone produce no path; the per-server rules cover risky configuration.
Severity comes from what the composition reaches. AP001 is critical when the read reaches home or credential directories and the egress is unconstrained; high for project-scoped reads or authenticated channels (GitHub, Slack, email); medium or low when both are limited. AP003 is critical when a reachable file executes at the next session start (
.mcp.json, ~/.claude.json, hooks, shell startup files); high for instruction files such as CLAUDE.md.
Confidence comes from how the capabilities were observed: live tool list high, package inference medium, undeclared scope lower.
Paths compose over name-sorted servers, so they never depend on discovery order.
Scope matters
For filesystem servers the allowed roots come from the arguments in your client config.~ or / (or any ancestor of home) is sensitive: it reaches ~/.ssh, ~/.aws, browser profiles. A project directory is project: it may still hold .env or key files, so a project read plus open egress is HIGH rather than CRITICAL.
Resources and destinations
Sensitive resources are derived, not configured: credential directories and browser profiles when a read reaches home; agent-state files when a write reaches them; the database when a database server exists. Destinations are fixed hosts implied by a package (github.com, slack.com) or “arbitrary https” for open egress.In the output
Every path shows the two capabilities, the evidence for both, the path hop by hop, the impact and a fix.aspex scan --json adds attackPaths and scoreCapReason; aspex scan attack-paths --json lists every server’s capabilities with evidence. aspex scan →