puck-scout, from Puck Security, is an MCP server that uses AI to inspect a host's security posture via natural language queries. The tool accepts conversational prompts about local systems and returns human-readable investigative responses and suggested containment steps, aimed at accelerating host triage. It fits into MCP-enabled workflows and pairs with local AI clients for audits. Security engineers, red teamers, and developers gain query-driven reconnaissance to surface forgotten credentials and configuration mistakes.

What tasks can you actually use it for?

puck-scout automates focused on-host reconnaissance and extracts actionable evidence from the filesystem and runtime state. It finds plaintext AWS keys, GitHub personal access tokens, unencrypted SSH keys, cached OAuth tokens, and misconfigured Docker or system services. Typical jobs include quick sweeps for forgotten credentials, targeted checks of privileged configuration files, and initial host triage during incidents. Example outputs pair discovered items with containment suggestions and impact notes.

How accurate are the outputs compared to doing it manually?

The tool runs reachability checks and a credential validation step to determine whether discovered secrets are actually exploitable, a behavior the developer calls Calibrated Detection to reduce noisy findings. Model reasoning uncovers nuanced issues such as tokens leaked in shell history or over-privileged config files that simple pattern scans miss. Generated findings should be treated as investigative leads, and operators need to verify high-risk items before remediation.

Does it require technical knowledge to get useful results?

Installation requires building two binaries: a Go-based MCP server and a Rust-based agent, and an MCP host such as Claude Desktop for model interactions. Supported platforms include macOS, Linux, and Windows. The design intentionally avoids installing a persistent daemon or kernel drivers by operating in a read-only mode to limit host changes. Integrations list AI coding agents like Claude Code and Cursor for pipeline-style audits via MCP-compatible clients.

Best used as an AI-assisted triage companion, not a final auditor

For teams that accept AI-assisted host leads, puck-scout serves as a rapid triage companion that surfaces high-impact issues for operator follow-up. Its outputs are investigative prompts rather than authoritative fixes, so feed findings into established incident response playbooks and require human verification before corrective action. The tool suits operators who pair automated host sweeps with disciplined manual validation and follow-up audits.