krysta

Security scanner for MCP (Model Context Protocol) servers. Discovers every MCP server configured on your machine — Claude Desktop, Cursor, VS Code — and checks each one for known vulnerability patterns: command injection, path traversal, SSRF, credential exposure, SQL injection, and tool description poisoning.

Quick start

npx krysta probe --deep

That's it. No config, no signup required. It finds your MCP servers, connects to each one, and reports what it finds.

What it does

• Discovers MCP servers from claude_desktop_config.json, .cursor/mcp.json, and mcp_settings.json
• Connects to each server over its actual transport (stdio or SSE) and speaks the MCP protocol directly
• Inspects the published npm package source code for known-dangerous patterns
• Confirms select findings with safe, uniquely-tagged test payloads — separating real, exploitable issues from suspected ones

Usage

# Basic scan (config-level checks only)
npx krysta probe

# Full scan — connects to servers, downloads and inspects source, runs dynamic checks
npx krysta probe --deep

# Scan a specific config path
npx krysta probe --path "path/to/config/directory"

# Send results to your dashboard (requires krysta login first)
npx krysta probe --deep --upload

Output

After scanning, results are written to ~/.krysta/krysta-report.json (full findings) and ~/.krysta/krysta-mesh-policy.yaml (an auto-generated policy file you can feed directly into krysta-mesh, a runtime gateway that blocks or logs risky tool calls in real time).

Links

• Documentation
• GitHub

License

MIT