MCP Security Scanner

A production-grade MCP (Model Context Protocol) server that scans MCP configurations, tool definitions, and server deployments for security vulnerabilities.

Why This Matters

The MCP ecosystem experienced a surge of security disclosures in late 2025 and early 2026:

• 30+ CVEs were published affecting MCP servers between January and February 2026 alone.
• 82% of MCP implementations tested by security researchers were vulnerable to path traversal attacks.
• Tool poisoning and prompt injection via malicious tool descriptions emerged as a novel attack vector unique to AI tool ecosystems.
• Several incidents involved data exfiltration through MCP servers that accepted arbitrary URLs while also accessing sensitive local data.

MCP Security Scanner helps you find these issues before attackers do.

Features

| Tool | What It Does | |------|-------------| | scan_config | Scans MCP config files for hardcoded secrets, excessive permissions, insecure transports, missing auth, and known vulnerable servers | | scan_tool_definitions | Detects prompt injection, tool poisoning, overly broad filesystem access, command injection risks, and data exfiltration patterns in tool definitions | | check_cves | Checks server names/versions against a curated database of 20 known MCP CVEs covering path traversal, SSRF, auth bypass, prompt injection, and more | | validate_auth | Validates OAuth 2.1, API key, and bearer token configurations for PKCE, token storage, redirect URIs, expiration, and best practices | | generate_report | Produces a Markdown report with risk score (0-100), detailed findings, remediation steps, and SOC 2 compliance checklist |

Pricing

| Plan | Price | | |------|-------|---| | Free trial | $0 | 3 calls total (shared across all tools), no credit card — just run it | | Personal | $19/mo | Buy → | | Team | $79/mo | Buy → | | Enterprise | $499/mo | Buy → |

License keys are emailed instantly after checkout. Activate via the LICENSE_KEY environment variable. More info: aivp-mcp.vercel.app

Installation

Note: the npm package is mcp-server-security-scanner (not the bare name security-scanner).

No install step needed — run straight from npm:

npx -y mcp-server-security-scanner

Or install globally:

npm install -g mcp-server-security-scanner

Usage

As a stdio MCP server (recommended for local use)

Add to your Claude Desktop configuration (claude_desktop_config.json):

{
  "mcpServers": {
    "security-scanner": {
      "command": "npx",
      "args": ["-y", "mcp-server-security-scanner"],
      "env": { "LICENSE_KEY": "<your license key — omit for free trial>" }
    }
  }
}

Or add the same block to your project's .mcp.json.

As an HTTP server (for remote/shared deployments)

# Start on default port 3000
npx -y mcp-server-security-scanner --http

# Or specify a port
PORT=8080 npx -y mcp-server-security-scanner --http

Connect clients to http://localhost:3000/mcp using Streamable HTTP transport.

Tool Reference

scan_config

Scans an MCP configuration file for security issues.

Input:

{
  "configPath": "~/.claude/claude_desktop_config.json"
}

Checks performed:

• Hardcoded API keys, tokens, passwords, and private keys (11 secret patterns)
• Servers running with root/elevated privileges
• Docker containers without security restrictions
• Deno/Node processes with unrestricted permissions
• stdio servers without container/sandbox isolation
• HTTP servers missing authorization headers
• Plain HTTP (non-TLS) connections to remote servers
• Servers matching known vulnerable package names

scan_tool_definitions

Analyzes tool definitions for prompt injection and other attack vectors.

Input:

{
  "tools": [
    {
      "name": "read_file",
      "description": "Reads a file from the filesystem",
      "inputSchema": {
        "type": "object",
        "properties": {
          "path": { "type": "string", "description": "File path to read" }
        }
      }
    }
  ]
}

Checks performed:

• Hidden system instructions in tool descriptions
• Role override / instruction boundary escape attempts
• Invisible Unicode characters hiding payloads
• Cross-tool manipulation directives
• Data collection and exfiltration instructions
• Approval/confirmation bypass patterns
• Unrestricted path/command/URL parameters
• Overly broad filesystem access patterns
• Unusually long descriptions (>2000 chars)

check_cves

Checks servers against the built-in CVE database.

Input:

{
  "servers": [
    { "name": "@modelcontextprotocol/server-filesystem", "version": "0.5.0" },
    { "name": "mcp-server-git" }
  ]
}

To list all CVEs in the database:

{
  "servers": [],
  "listAll": true
}

CVE database covers:

• Path traversal (5 CVEs) -- including symlink and Unicode normalization variants
• SSRF (2 CVEs) -- direct and redirect-based
• Authentication bypass (3 CVEs) -- OAuth state forgery, missing SSE auth, API key leaks
• Prompt injection (3 CVEs) -- tool description injection, registry poisoning, stored injection
• Data exfiltration (2 CVEs) -- DNS rebinding, URL-based data encoding
• Command injection (2 CVEs) -- shell metacharacters, unsanitized git refs
• SQL injection (1 CVE) -- string concatenation queries

validate_auth

Validates authentication configuration against best practices.

Input:

{
  "authConfig": {
    "type": "oauth",
    "oauth": {
      "clientId": "my-app",
      "authorizationUrl": "https://auth.example.com/authorize",
      "tokenUrl": "https://auth.example.com/token",
      "redirectUri": "https://myapp.com/callback",
      "scopes": ["read", "write"],
      "pkce": true,
      "tokenExpiration": 3600,
      "refreshTokenRotation": true
    }
  }
}

Checks performed:

• OAuth 2.1 compliance (PKCE requirement, required fields)
• Client secret storage (should not be in config files)
• Redirect URI security (HTTPS, no wildcards, valid scheme)
• Token expiration settings (flags >1 hour or non-expiring)
• Token storage method (flags localStorage, plaintext)
• Refresh token rotation
• Scope configuration (least privilege)
• API key and bearer token storage

generate_report

Generates a comprehensive Markdown security report.

Input: Pass the results from any combination of the other four tools:

{
  "configScan": { "..." : "result from scan_config" },
  "toolScan": { "..." : "result from scan_tool_definitions" },
  "cveCheck": { "..." : "result from check_cves" },
  "authValidation": { "..." : "result from validate_auth" }
}

Report includes:

• Executive summary with risk score (0-100) and risk level
• Finding counts by severity (critical/high/medium/low/info)
• Detailed findings grouped by severity with remediation steps
• SOC 2 Trust Service Criteria compliance checklist (8 checks)

Pricing

| Plan | Price | Includes | |------|-------|----------| | Personal | $19/mo | Single user, stdio transport, community support | | Team | $79/mo | Up to 10 users, HTTP transport, priority support, CI/CD integration guide | | Enterprise | $499/mo | Unlimited users, custom CVE feeds, SIEM integration, dedicated support, SLA |

All plans include access to the full CVE database with monthly updates.

Contact sales for enterprise trials and volume licensing.

Development

# Watch mode for development
npm run dev

# Build
npm run build

# Run with stdio
npm start

# Run with HTTP transport
npm run start:http

Architecture

src/
  index.ts              Main server -- registers all tools, handles transport
  types.ts              Shared TypeScript types for all modules
  tools/
    scan-config.ts      Config file scanner (secrets, permissions, transport, known vulns)
    scan-tools.ts       Tool definition scanner (injection, poisoning, exfiltration)
    check-cves.ts       CVE database lookup with semver matching
    validate-auth.ts    Auth config validator (OAuth 2.1, API key, bearer)
    report.ts           Report generator (risk score, findings, SOC 2 checklist)
  data/
    cve-database.ts     20 curated MCP CVE entries
    patterns.ts         Detection signatures (secrets, injection, filesystem, commands)

License

MIT