sigil

Deep static security analysis for MCP servers. Finds command injection, path traversal, tool poisoning, credential leaks, and 12 other vulnerability classes — source code analysis that goes beyond description scanning.

The Problem

MCP servers are the bridge between AI agents and the real world — file systems, databases, APIs, shell commands. They're also largely unaudited. Studies of MCP implementations found 34% using APIs prone to command injection, 82% using file operations prone to path traversal, and 5.5% with active tool poisoning in their descriptions. Existing scanners check tool descriptions and metadata. They don't read the source code. sigil does.

What sigil Does

• Source code analysis — Reads TypeScript and Python source, detects dangerous patterns in tool handlers (exec, eval, fs, SQL), flags unsanitized paths. Goes beyond description scanning — analyzes what your code actually does.
• 16 security rules across 7 categories — Injection, permissions, data exfiltration, input validation, tool description integrity, authentication, configuration. Each rule maps to documented MCP attack vectors and real CVEs.
• Trust score (0-100) — Quantified security posture with A-F grading. Exit code 1 on FAIL for CI/CD gating. One critical finding = 75 or below.

Quick Start

npx @sigildev/sigil .

  Sigil v0.2.0

  Scanning: ./my-mcp-server
  Language: TypeScript
  Tools: 5 detected | Resources: 2 detected | Prompts: 0 detected

  CRITICAL  MCS-INJ-001  Command Injection via tool input
  │ src/tools/run-command.ts:24
  │ Tool "execute" passes user input directly to child_process.exec()
  │ without sanitization. Allows arbitrary command execution.
  │
  │   23│ server.tool("execute", { cmd: z.string() }, async ({ cmd }) => {
  │ > 24│   const result = await exec(cmd);
  │   25│   return { content: [{ type: "text", text: result.stdout }] };

  HIGH  MCS-PERM-002  Unrestricted filesystem access
  │ src/tools/files.ts:12
  │ Tool "read_file" accepts arbitrary paths with no allowlist or
  │ directory restriction. Can read /etc/passwd, SSH keys, .env files.

  HIGH  MCS-DATA-001  Environment variable exposure
  │ src/tools/debug.ts:8
  │ Tool "get_env" returns process.env without filtering.
  │ Exposes API keys, credentials, and secrets to the LLM.

  MEDIUM  MCS-VALID-001  Missing input schema
  │ src/tools/search.ts:31
  │ Tool "search" has no input validation schema defined.
  │ All inputs accepted without type or constraint checking.

  LOW  MCS-CFG-002  Verbose error messages
  │ src/index.ts:45
  │ Error handler returns full stack traces to the client.

  ──────────────────────────────────────────────────────
  5 findings: 1 critical, 2 high, 1 medium, 1 low
  Trust Score: 32/100 (FAIL)
  ──────────────────────────────────────────────────────

Installation

# Run without installing
npx @sigildev/sigil .

# Install globally
npm install -g @sigildev/sigil

# Install as dev dependency
npm install -D @sigildev/sigil

Usage

# Scan an MCP server directory
sigil .
sigil ./servers/github-server

# Scan all servers in a config file
sigil claude_desktop_config.json
sigil .mcp.json

# Machine-readable output
sigil . --output json
sigil . --output sarif

# Filter by severity
sigil . -s high          # Only high and critical findings

# Ignore specific rules
sigil . --ignore MCS-CFG-002,MCS-DEP-002

# Quiet mode (findings only, no banner)
sigil . -q

What It Checks

16 rules across 7 categories. Each maps to real MCP attack vectors and documented CVEs.

| ID | Rule | Severity | What it detects | |----|------|----------|-----------------| | MCS-INJ-001 | Command Injection | CRITICAL | Tool inputs passed to exec, spawn(shell), os.system, subprocess.run(shell=True) | | MCS-INJ-002 | SQL Injection | CRITICAL | Tool inputs concatenated into SQL strings without parameterized queries | | MCS-INJ-003 | Path Traversal | HIGH | Tool inputs used in file paths without canonicalization or directory restriction | | MCS-PERM-001 | Overly Broad Capabilities | HIGH | Tools performing dangerous ops (write, delete, fetch, exec) without scope restrictions | | MCS-PERM-002 | Unrestricted FS Access | HIGH | File system tools with no directory allowlist or path prefix restriction | | MCS-PERM-003 | Arbitrary Code Execution | CRITICAL | Tool inputs passed to eval(), Function(), exec(), vm.runInNewContext | | MCS-DATA-001 | Env Variable Exposure | HIGH | process.env or os.environ returned wholesale without filtering | | MCS-DATA-002 | Credential Leakage | HIGH | Unfiltered API responses containing auth tokens, session IDs, or credentials | | MCS-VALID-001 | Missing Input Schema | MEDIUM | Tools registered with empty or absent input validation schemas | | MCS-DESC-001 | Suspicious Descriptions | HIGH | Prompt injection patterns in tool descriptions (override instructions, exfiltration URLs, cross-tool calls) | | MCS-AUTH-001 | Hardcoded Credentials | CRITICAL | API keys, tokens, passwords hardcoded in source (sk-*, ghp_*, AKIA*, private keys) | | MCS-AUTH-002 | Secrets in Config | HIGH | Credentials inline in MCP config files instead of env var references | | MCS-CFG-001 | Debug Mode Enabled | MEDIUM | Debug/development configuration left enabled | | MCS-CFG-002 | Verbose Error Messages | LOW | Error handlers returning full stack traces to the client | | MCS-CFG-003 | Insecure Transport | MEDIUM | HTTP without TLS, binding to 0.0.0.0, CORS with * | | MCS-DEP-001 | Vulnerable Dependencies | Varies | Dependencies with known CVEs (queried against OSV.dev) |

Output Formats

Text (default)

Human-readable terminal output with color-coded severity badges and inline code excerpts. See Quick Start above.

JSON

sigil . --output json

Produces a structured ScanResult object with full finding details, tool/resource/prompt inventory, and trust score. Pipe to jq or consume programmatically.

SARIF

sigil . --output sarif

SARIF v2.1.0 output for integration with GitHub Code Scanning, VS Code SARIF Viewer, and other SARIF-compatible tools. Upload directly to GitHub:

sigil . --output sarif > results.sarif
# Upload to GitHub Code Scanning via API or Action

Trust Score

Score = 100 - penalties

CRITICAL  = -25 points each
HIGH      = -15 points each
MEDIUM    = -5 points each
LOW       = -2 points each

A (90-100) = PASS    D (30-49) = FAIL
B (70-89)  = PASS    F (0-29)  = FAIL
C (50-69)  = WARN

Exit code 0 on PASS (score >= 70). Exit code 1 on FAIL. Use in CI/CD to block deployments.

Configuration

Create .sigil.yml in your project root:

# Rules to ignore
ignore:
  - MCS-CFG-002    # We intentionally show verbose errors in dev
  - MCS-DEP-002    # We know this server is maintained

# Severity overrides
overrides:
  MCS-VALID-001: low    # Downgrade missing schema for our use case

# Paths to exclude
exclude:
  - "tests/**"
  - "examples/**"
  - "**/*.test.ts"

# Minimum score to pass (default: 70)
passScore: 60

How It Works

Three-layer analysis pipeline. No dynamic analysis — the scanner never runs your MCP server.

1. Discovery — Finds MCP server entry points, parses config files (claude_desktop_config.json, .mcp.json), reads package.json/pyproject.toml, discovers source files.
2. Analysis — 16 rules run against source code:
   • Pattern Analyzer — Tool-handler-scoped regex detection for injection sinks, dangerous permissions, credential leaks, prompt injection, and configuration issues. Only flags patterns found within MCP tool handler contexts (.tool(), @mcp.tool()), skips build scripts, CLI utilities, and test fixtures.
   • Dependency Checker — Parses dependency manifests, queries OSV.dev for known CVEs.
3. Reporting — Aggregates findings, computes trust score, formats output.

Comparison

| Feature | sigil | Snyk agent-scan | Cisco Sigil | Enkrypt AI | |---------|-------------|-----------------|-------------------|------------| | Open source | MIT | Partial | Partial | No | | Analysis depth | Source code pattern analysis | Description scanning | YARA rules + LLM | Agentic static | | Languages | TypeScript + Python | Runtime only | Unknown | GitHub repos | | Trust scoring | 0-100 + A-F grade | Pass/fail | None | Per-finding | | SARIF output | Yes | No | No | No | | Config scanning | Yes | No | No | No | | Dependency scanning | Yes (OSV.dev) | No | No | No | | Description poisoning | Yes | Yes | Yes (LLM) | Yes | | Cost | Free | Free (scanner), paid (platform) | Free (scanner), paid (API) | Free tier, paid |

Our edge: Deep source code analysis (not just description scanning), both TypeScript and Python, trust scoring, config file scanning, dependency checking, and SARIF output — in a single free, open-source CLI. No account required. No data sent to external services (except OSV.dev for dependency CVE checks).

Supported MCP Frameworks

• @modelcontextprotocol/sdk (TypeScript) — server.tool(), server.resource(), server.prompt()
• mcp / FastMCP (Python) — @mcp.tool(), @mcp.resource(), @mcp.prompt()

Contributing

Contributions welcome. Areas where help is needed:

• New rules — See the rule template in src/rules/. Each rule is a self-contained module.
• Language support — Go, Rust, Java MCP server analysis.
• False positive reports — If the scanner flags safe code, open an issue with a minimal repro.
• Real-world validation — Run the scanner on your MCP servers and share results (with permission).

git clone https://github.com/sigildev/sigil
cd sigil
npm install
npm test
npm run dev -- ./tests/fixtures/vulnerable-ts

License

MIT