`flintai scan`: extend the whitebox lens from agent *code* to agent *configuration* (MCP servers + manifests)

flintai scan's whitebox read of agent code is excellent, and eval covers runtime behaviour — together that's most of the picture. The piece we'd love to see it reach is the connective tissue in between: an agent's declared capabilities.

Ask: teach flintai scan to statically analyse MCP server configurations (including the mcpServers block of claude_desktop_config.json) and agent manifests, flagging patterns such as:

• Over-broad grants — a filesystem server scoped to / or $HOME rather than a single working directory.
• Execution surfaces — tools that can exec/eval/spawn, inherited by any connected agent with no human in the loop by default.
• Secrets in config — API keys sitting in an env block: unrotatable, and readable by anyone with the file.
• Remote MCP servers with no declared authentication.
• Manifests that declare no identity, scope, delegation, or approval boundary.

Why it matters. Increasingly, an agent's real blast radius isn't in its Python — it's in what it's allowed to reach. The MCP config is where "read one file" quietly becomes "read the entire home directory," and it's the part that most often ships unreviewed. It's a natural extension of the whitebox philosophy: scan already reads what the agent is; this reads what it's been given. And it pairs beautifully with eval — static over-privilege findings tell you exactly where to aim the runtime red-team.*

Filed with genuine admiration from the KXCO team (kxco.ai) — building in the same neighbourhood (post-quantum security + AI trust) and rooting for FlintAI.

Start with the existing flintai scan whitebox analysis and its eval entry point, then inspect how claude_desktop_config.json is represented. Define the supported MCP configuration and agent manifest inputs before implementing findings for broad filesystem grants, execution tools, config secrets, unauthenticated remote servers, and missing boundaries. Done means scan reports these cases with actionable locations and tests cover representative configurations.