> ## Documentation Index
> Fetch the complete documentation index at: https://aspex.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# aspex mcp

> Let your agent ask Aspex before it changes its own configuration: a read-only MCP server.

```sh theme={"dark"}
claude mcp add aspex -- aspex-scan mcp --no-exec
```

```json theme={"dark"}
{ "mcpServers": { "aspex": { "command": "aspex-scan", "args": ["mcp", "--no-exec"] } } }
```

`aspex-scan mcp` serves Aspex over the Model Context Protocol on stdin/stdout. The point is a workflow like this:

```
Agent:  I want to add a filesystem server with access to /.
        → aspex_security_impact({ mcp_json: <proposed .mcp.json> })

Aspex:  verdict: introduces a CRITICAL attack path
        blast_radius_before: MEDIUM  blast_radius_after: HIGH
        attack_paths_added: [AP001 filesystem + browser: sensitive data exfiltration, ...]
        changes: FILESYSTEM SCOPE EXPANDED, credential directories newly reachable, ...
```

Aspex does not block the edit. It makes the consequence visible before the edit, to the thing about to make it.

## Tools

| Tool                     | Returns                                                                                                                                                                                                                                                                                                                                                |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `aspex_security_impact`  | drift between the current environment and a proposed `.mcp.json` (plus optional `.claude/settings.json` hooks): verdict, blast radius before/after, security-relevant changes, attack paths added and removed. The proposal is analyzed statically and never launched. Existing user-level servers are included so compositions with them are visible. |
| `aspex_explain`          | the deterministic answer to a security question (see [explain](/tools/explain))                                                                                                                                                                                                                                                                        |
| `aspex_scan`             | agents, servers with capabilities and scope, hook and skill counts, blast radius with reasons, attack path counts                                                                                                                                                                                                                                      |
| `aspex_get_capabilities` | every server's capabilities, roots, scope, egress class, agent-state writes                                                                                                                                                                                                                                                                            |
| `aspex_get_attack_paths` | AP001-AP006 with evidence, impact, remediation                                                                                                                                                                                                                                                                                                         |
| `aspex_verify`           | drift against a lockfile (`.lock` or `.json` paths only)                                                                                                                                                                                                                                                                                               |

## Read-only by construction

There are no write, exec, fix or configuration tools. The server cannot modify files, run commands, or change Aspex's own policy, lockfile or baseline. `aspex_verify` reads only lockfiles. The environment is computed once per process and cached; restart the server to rescan.

The tool list is fixed in code and covered by a test that fails if a tool name ever looks like a write or exec action.