mcp-server-security-scanner

MCP Security Scanner

A production-grade MCP (Model Context Protocol) server that scans MCP configurations, tool definitions, and server deployments for security vulnerabilities.

Why This Matters

The MCP ecosystem experienced a surge of security disclosures in late 2025 and early 2026:

• 30+ CVEs were published affecting MCP servers between January and February 2026 alone.
• 82% of MCP implementations tested by security researchers were vulnerable to path traversal attacks.
• Tool poisoning and prompt injection via malicious tool descriptions emerged as a novel attack vector unique to AI tool ecosystems.
• Several incidents involved data exfiltration through MCP servers that accepted arbitrary URLs while also accessing sensitive local data.

MCP Security Scanner helps you find these issues before attackers do.

Features

Tool	What It Does
scan_config	Scans MCP config files for hardcoded secrets, excessive permissions, insecure transports, missing auth, and known vulnerable servers
scan_tool_definitions	Detects prompt injection, tool poisoning, overly broad filesystem access, command injection risks, and data exfiltration patterns in tool definitions
check_cves	Checks server names/versions against a curated database of 20 known MCP CVEs covering path traversal, SSRF, auth bypass, prompt injection, and more
validate_auth	Validates OAuth 2.1, API key, and bearer token configurations for PKCE, token storage, redirect URIs, expiration, and best practices
generate_report	Produces a Markdown report with risk score (0-100), detailed findings, remediation steps, and SOC 2 compliance checklist

Pricing

Plan	Price
Free trial	$0	3 calls total (shared across all tools), no credit card — just run it
Personal	$19/mo	Buy →
Team	$79/mo	Buy →
Enterprise	$499/mo	Buy →

License keys are emailed instantly after checkout. Activate via the LICENSE_KEY environment variable. More info: aivp-mcp.vercel.app

Installation

Note: the npm package is mcp-server-security-scanner (not the bare name security-scanner).

No install step needed — run straight from npm:

npx -y mcp-server-security-scanner

Or install globally:

npm install -g mcp-server-security-scanner

Usage

As a stdio MCP server (recommended for local use)

Add to your Claude Desktop configuration (claude_desktop_config.json):

{
  "mcpServers": {
    "security-scanner": {
      "command": "npx",
      "args": ["-y", "mcp-server-security-scanner"],
      "env": { "LICENSE_KEY": "<your license key — omit for free trial>" }
    }
  }
}

Or add the same block to your project's .mcp.json.

As an HTTP server (for remote/shared deployments)

# Start on default port 3000
npx -y mcp-server-security-scanner --http

# Or specify a port
PORT=8080 npx -y mcp-server-security-scanner --http

Connect clients to http://localhost:3000/mcp using Streamable HTTP transport.

Tool Reference

scan_config

Scans an MCP configuration file for security issues.

Input:

{
  "configPath": "~/.claude/claude_desktop_config.json"
}

Checks performed:

• Hardcoded API keys, tokens, passwords, and private keys (11 secret patterns)
• Servers running with root/elevated privileges
• Docker containers without security restrictions
• Deno/Node processes with unrestricted permissions
• stdio servers without container/sandbox isolation
• HTTP servers missing authorization headers
• Plain HTTP (non-TLS) connections to remote servers
• Servers matching known vulnerable package names

scan_tool_definitions

Analyzes tool definitions for prompt injection and other attack vectors.

Input:

{
  "tools": [
    {
      "name": "read_file",
      "description": "Reads a file from the filesystem",
      "inputSchema": {
        "type": "object",
        "properties": {
          "path": { "type": "string", "description": "File path to read" }
        }
      }
    }
  ]
}

Checks performed:

• Hidden system instructions in tool descriptions
• Role override / instruction boundary escape attempts
• Invisible Unicode characters hiding payloads
• Cross-tool manipulation directives
• Data collection and exfiltration instructions
• Approval/confirmation bypass patterns
• Unrestricted path/command/URL parameters
• Overly broad filesystem access patterns
• Unusually long descriptions (>2000 chars)

check_cves

Checks servers against the built-in CVE database.

Input:

{
  "servers": [
    { "name": "@modelcontextprotocol/server-filesystem", "version": "0.5.0" },
    { "name": "mcp-server-git" }
  ]
}

To list all CVEs in the database:

{
  "servers": [],
  "listAll": true
}

CVE database covers:

• Path traversal (5 CVEs) -- including symlink and Unicode normalization variants
• SSRF (2 CVEs) -- direct and redirect-based
• Authentication bypass (3 CVEs) -- OAuth state forgery, missing SSE auth, API key leaks
• Prompt injection (3 CVEs) -- tool description injection, registry poisoning, stored injection
• Data exfiltration (2 CVEs) -- DNS rebinding, URL-based data encoding
• Command injection (2 CVEs) -- shell metacharacters, unsanitized git refs
• SQL injection (1 CVE) -- string concatenation queries

validate_auth

Validates authentication configuration against best practices.

Input:

{
  "authConfig": {
    "type": "oauth",
    "oauth": {
      "clientId": "my-app",
      "authorizationUrl": "https://auth.example.com/authorize",
      "tokenUrl": "https://auth.example.com/token",
      "redirectUri": "https://myapp.com/callback",
      "scopes": ["read", "write"],
      "pkce": true,
      "tokenExpiration": 3600,
      "refreshTokenRotation": true
    }
  }
}

Checks performed:

• OAuth 2.1 compliance (PKCE requirement, required fields)
• Client secret storage (should not be in config files)
• Redirect URI security (HTTPS, no wildcards, valid scheme)
• Token expiration settings (flags >1 hour or non-expiring)
• Token storage method (flags localStorage, plaintext)
• Refresh token rotation
• Scope configuration (least privilege)
• API key and bearer token storage

generate_report

Generates a comprehensive Markdown security report.

Input: Pass the results from any combination of the other four tools:

{
  "configScan": { "..." : "result from scan_config" },
  "toolScan": { "..." : "result from scan_tool_definitions" },
  "cveCheck": { "..." : "result from check_cves" },
  "authValidation": { "..." : "result from validate_auth" }
}

Report includes:

• Executive summary with risk score (0-100) and risk level
• Finding counts by severity (critical/high/medium/low/info)
• Detailed findings grouped by severity with remediation steps
• SOC 2 Trust Service Criteria compliance checklist (8 checks)

Pricing

Plan	Price	Includes
Personal	$19/mo	Single user, stdio transport, community support
Team	$79/mo	Up to 10 users, HTTP transport, priority support, CI/CD integration guide
Enterprise	$499/mo	Unlimited users, custom CVE feeds, SIEM integration, dedicated support, SLA

All plans include access to the full CVE database with monthly updates.

Contact sales for enterprise trials and volume licensing.

Development

# Watch mode for development
npm run dev

# Build
npm run build

# Run with stdio
npm start

# Run with HTTP transport
npm run start:http

Architecture

src/
  index.ts              Main server -- registers all tools, handles transport
  types.ts              Shared TypeScript types for all modules
  tools/
    scan-config.ts      Config file scanner (secrets, permissions, transport, known vulns)
    scan-tools.ts       Tool definition scanner (injection, poisoning, exfiltration)
    check-cves.ts       CVE database lookup with semver matching
    validate-auth.ts    Auth config validator (OAuth 2.1, API key, bearer)
    report.ts           Report generator (risk score, findings, SOC 2 checklist)
  data/
    cve-database.ts     20 curated MCP CVE entries
    patterns.ts         Detection signatures (secrets, injection, filesystem, commands)

License

MIT