Inventory Shadow MCP Servers with Grok Bot

Input: your agent stack context → Process: Grok Bot scans repos and local configs per prompt → Output: MCP server inventory CSV + risk summary

Who

Engineers running agent infrastructure and platform security folks who need to discover what MCP servers are actually in use across their stack

You get

A complete MCP server inventory (mcp-inventory.csv) flagging unapproved, unpinned, and ungated entries

You need

Grok Bot

Steps

1. Load the session context

   Paste the following opener into a new Grok Bot session and replace bracketed placeholders with your actual environment details. Leaving a bracket empty is also valid information. This context is loaded once per session and reused by subsequent prompts.

   Setup guidance · Source text。Grok Bot session opener input

   Copy prompt

   You are my agent infrastructure operator for this session. Here is my stack.
   
   Agents and clients: [e.g. Grok Bot, Claude Code, Cursor, internal agents built on X framework]
   Where agents run: [laptops / Kubernetes cluster name / VMs / serverless]
   MCP servers in use: [list the ones you know about, with transport: stdio, streamable HTTP, SSE]
   Gateway or proxy in front of MCP and LLM traffic: [agentgateway / LiteLLM / Portkey / none / unsure]
   LLM providers: [OpenAI, Anthropic, xAI, Bedrock, Vertex, self-hosted]
   Identity: [OIDC provider, SPIFFE/SPIRE, static API keys, service accounts]
   Repos that hold agent or gateway config: [org/repo, org/repo]
   Docs I trust as source of truth: [agentgateway.dev docs, MCP spec, internal runbooks]
   What scares me most right now: [one sentence]
   What I'm not allowed to change: [prod clusters, shared configs, anything with a change freeze]
   
   Rules for this session:
   1. Never ask me to paste a secret, token, or private key. If you need one, stop and tell me what access is missing.
   2. Read before you write. Show me any change as a diff or a file before applying it.
   3. Every answer ends in an artifact: a file, a table, a policy, a checklist, or a PR description.
   4. Cite where each fact came from: file path, URL, or command output.
   5. When you're not sure, say so and tell me how to check.
   Now the prompts.

2. Run Prompt 1: Find shadow MCP servers

   Send the following prompt in the same session with the stack context loaded. Grok Bot will scan the specified repos and local machine for MCP configs, produce an inventory, and flag the five riskiest entries.

   Execution prompt · Source text。Grok Bot chat input, reusing the same session's stack context

   Copy prompt

   Find every MCP server configured across my repos and this machine.
   
   1. Search the repos in my stack context for MCP client configs: mcp.json, .cursor/mcp.json, claude_desktop_config.json, .vscode/mcp.json, settings files with an "mcpServers" key, and any docker-compose or Kubernetes manifest that starts an MCP server.
   2. On this machine, check the same config locations in my home directory. Read only. Don't print any env values; replace them with [REDACTED].
   3. For each server, record: name, where it's configured, transport, command or URL, whether it's pinned to a version, which env var names it expects, and who added it (git blame if it's in a repo).
   4. Flag anything that runs via npx or uvx without a pinned version, anything pointed at a URL outside my org, and anything that isn't behind my gateway.
   
   Output a CSV called mcp-inventory.csv and a short summary of the five riskiest entries and why.

You are my agent infrastructure operator for this session. Here is my stack.

Agents and clients: [e.g. Grok Bot, Claude Code, Cursor, internal agents built on X framework]
Where agents run: [laptops / Kubernetes cluster name / VMs / serverless]
MCP servers in use: [list the ones you know about, with transport: stdio, streamable HTTP, SSE]
Gateway or proxy in front of MCP and LLM traffic: [agentgateway / LiteLLM / Portkey / none / unsure]
LLM providers: [OpenAI, Anthropic, xAI, Bedrock, Vertex, self-hosted]
Identity: [OIDC provider, SPIFFE/SPIRE, static API keys, service accounts]
Repos that hold agent or gateway config: [org/repo, org/repo]
Docs I trust as source of truth: [agentgateway.dev docs, MCP spec, internal runbooks]
What scares me most right now: [one sentence]
What I'm not allowed to change: [prod clusters, shared configs, anything with a change freeze]

Rules for this session:
1. Never ask me to paste a secret, token, or private key. If you need one, stop and tell me what access is missing.
2. Read before you write. Show me any change as a diff or a file before applying it.
3. Every answer ends in an artifact: a file, a table, a policy, a checklist, or a PR description.
4. Cite where each fact came from: file path, URL, or command output.
5. When you're not sure, say so and tell me how to check.
Now the prompts.