diff --git a/src/config.ts b/src/config.ts
index 5a8d4c2..188df45 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -26,6 +26,22 @@ export const DEFAULT_CONFIG: McpAuditConfig = {
   ignore: [],
 };
 
+const KNOWN_CONFIG_KEYS = new Set<string>([
+  "disabledRules",
+  "enabledRules",
+  "severityOverrides",
+  "failOn",
+  "ignore",
+]);
+
+function assertKnownConfigKeys(obj: Record<string, unknown>): void {
+  for (const key of Object.keys(obj)) {
+    if (!KNOWN_CONFIG_KEYS.has(key)) {
+      throw new Error(`Unknown config key "${key}".`);
+    }
+  }
+}
+
 const CONFIG_FILENAMES = [
   ".mcpauditrc",
   ".mcpauditrc.json",
@@ -62,6 +78,7 @@ export function normalizeConfig(
   base: McpAuditConfig = DEFAULT_CONFIG,
 ): McpAuditConfig {
   const obj = (raw ?? {}) as Record<string, unknown>;
+  assertKnownConfigKeys(obj);
   const config: McpAuditConfig = {
     disabledRules: [...base.disabledRules],
     enabledRules: [...base.enabledRules],
diff --git a/test/config.test.ts b/test/config.test.ts
index b1b20a2..2412fb4 100644
--- a/test/config.test.ts
+++ b/test/config.test.ts
@@ -24,6 +24,12 @@ describe("normalizeConfig", () => {
     expect(config.severityOverrides.MCP021).toBe("high");
   });
 
+  it("rejects unknown top-level config keys", () => {
+    expect(() =>
+      normalizeConfig({ disabledRule: ["MCP001"] }),
+    ).toThrow(/disabledRule/);
+  });
+
   it("rejects an invalid failOn severity", () => {
     expect(() => normalizeConfig({ failOn: "catastrophic" })).toThrow(
       /Invalid severity/,