🛡️ mcp-scan

Security scanner for Model Context Protocol servers. Point it at any running MCP server. It audits the live server against the OWASP MCP Top 10 and grades it A–F.

npx owasp-mcp-scan --stdio "npx -y @modelcontextprotocol/server-filesystem /tmp"

Why

MCP tool descriptions are fed straight into your model's context, and most public servers were never security-reviewed. A bad one can hide instructions in a description, expose a raw-shell tool, or leak a key; and your agent acts on it. Endor Labs found 82% of servers prone to path traversal, 34% to command injection.

mcp-scan is the gut-check before you wire a server in. It's passive: it reads advertised capabilities and analyzes them statically, never invoking tools, so it's safe against production servers.

Real findings on real servers

12 popular npm servers, actual output (snapshot 2026-07-11, full benchmark):

| Server | Tools | Grade | 🔴 | 🟠 | 🟡 | Notable | |---|---:|:---:|---:|---:|---:|---| | firecrawl-mcp | 26 | F | 2 | 11 | 1 | lethal trifecta (MCP10) + code exec (MCP05) | | @modelcontextprotocol/server-filesystem | 14 | F | 0 | 1 | 11 | unconstrained path params (MCP01) | | @modelcontextprotocol/server-puppeteer | 7 | F | 1 | 2 | 0 | script param executes JS (MCP05) | | tavily-mcp | 5 | F | 0 | 3 | 1 | untrusted-input + exfiltration (MCP10) | | @modelcontextprotocol/server-memory | 9 | F | 0 | 3 | 0 | delete_* tools, no confirmation (MCP02) | | @modelcontextprotocol/server-github | 26 | D | 0 | 0 | 2 | state-changing tools (MCP02) | | @modelcontextprotocol/server-slack | 8 | C | 0 | 1 | 0 | reads + posts = data + exfil (MCP10) | | @modelcontextprotocol/server-everything | 13 | A | 0 | 0 | 0 | clean ✓ | | @kazuph/mcp-fetch | 1 | A | 0 | 0 | 0 | clean ✓ |

9 of 12 flagged, 3 clean, every row audited finding-by-finding, false positives stripped rather than padded.

Use it

CLI

npx owasp-mcp-scan --stdio "<command>"                                  # local stdio server
npx owasp-mcp-scan --url https://host/mcp --header "Authorization: Bearer $TOKEN"
npx owasp-mcp-scan --config ~/.cursor/mcp.json --format sarif --output mcp.sarif

As an MCP server, let your agent scan servers on demand ("scan this MCP server before I add it"). Add to any client; this mcpServers shape works in Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, and Gemini CLI:

{ "mcpServers": { "mcp-scan": { "command": "npx", "args": ["-y", "owasp-mcp-scan", "--serve"] } } }

OpenAI Codex (~/.codex/config.toml):

[mcp_servers.mcp-scan]
command = "npx"
args = ["-y", "owasp-mcp-scan", "--serve"]

Exposes two tools: scan_mcp_server (audit a stdio/HTTP target) and list_checks.

Claude Code plugin

/plugin marketplace add CodingSelim/mcp-scan
/plugin install mcp-scan@mcp-scan

Also on the official MCP registry as io.github.CodingSelim/mcp-scan. Publishing steps: PUBLISHING.md.

What it checks

Full OWASP MCP Top 10 (2025) coverage, 12 checks:

| Check | OWASP | Catches | |---|---|---| | secret-exposure | MCP01 | AWS / OpenAI / Anthropic / GitHub / GitLab / Stripe / SendGrid / npm / HF / DB URIs / JWT / private keys in advertised text | | transport | MCP01 | Plaintext http:// to a non-loopback host | | path-traversal | MCP01 | file:///{path} templates and unconstrained path params | | excessive-scope | MCP02 | Destructive tools (delete, drop, transfer) with no confirmation | | tool-poisoning | MCP03 | Instruction overrides, hidden exfiltration directives, zero-width / Unicode-tag smuggling | | tool-shadowing | MCP03 / MCP09 | Duplicate tool-name collisions and "call me first" precedence injection | | supply-chain | MCP04 / MCP09 | Unpinned/placeholder versions and homoglyph server names | | command-injection | MCP05 | Unconstrained command / shell / code params, raw SQL, advertised execution | | ssrf | MCP05 | Arbitrary url / host params with no allowlist | | tool-poisoning (dynamic) | MCP06 | Injection in resource contents and server instructions | | authn | MCP07 | HTTP servers that complete an unauthenticated handshake | | telemetry | MCP08 | High-impact tools with no audit trail (advisory, unscored) | | toxic-flow | MCP10 | Lethal trifecta: one server that reads private data, ingests untrusted content, and can exfiltrate |

toxic-flow is the standout, it reasons across the whole toolset, catching the GitHub-MCP / email-agent injection shape that per-tool checks miss.

Output & CI

console (default) · json · sarif (GitHub Code Scanning). Exit code is non-zero at/above --fail-on (default high), so it gates CI:

- run: npx owasp-mcp-scan --url ${{ secrets.MCP_URL }} --format sarif --output mcp.sarif
- uses: github/codeql-action/upload-sarif@v3
  with: { sarif_file: mcp.sarif }

Notes

• Static analysis can't see runtime sandboxing, a server that safely confines paths still flags them. Verify against actual enforcement.
• Auth and transport checks apply to HTTP targets only.
• Heuristics favor recall; triage findings in context.
• Scanning a stdio target spawns that command, so run it only on servers you trust.

Develop

npm install && npm run build && npm test   # 48 tests, incl. live end-to-end fixture scans

Checks are pure and isolated (src/checks/), reusing detectors in src/detectors/. See CONTRIBUTING.md.

References

OWASP MCP Top 10 · MCP Security Cheat Sheet · Vulnerable MCP Project · MCPTox

MIT © CodingSelim