MCP Security Scanner

Comprehensive security scanner for Model Context Protocol (MCP) servers

Combines static code analysis, runtime probing, and cryptographic verification to detect vulnerabilities in MCP servers before and after deployment.

Features

Static Code Analysis

AST-based Python code scanning (JavaScript support planned):

PY001: Shell injection detection (os.system, subprocess with shell=True)
PY002: Path traversal patterns (../ in file operations)
PY003: Hardcoded secrets (AWS keys, API tokens, passwords)
PY004: Dangerous eval/exec usage
PY005: Insecure deserialization (pickle.loads, unsafe yaml.load)

Runtime Security Checks

Live server probing via HTTP transport:

RT001: Dangerous capabilities without input constraints
RT002: Prompt injection patterns in tool descriptions
RT003: Resource path traversal vulnerabilities

Cryptographic Verification

DNS/DNSSEC: Verify domain ownership via _mcp.<domain> TXT records
Nostr (Planned): NIP-05/NIP-89 decentralized verification

Flexible Output

JSON: Machine-readable for CI/CD integration
Text: Color-coded terminal output with severity indicators
Exit Codes: 0 for clean, 1 for issues found

Installation

Requirements

Python 3.10+
Poetry (recommended) or pip

Install with Poetry

git clone https://github.com/ca7ai/mcp-sec-scanner.git
cd mcp-sec-scanner
poetry install

Install with pip

git clone https://github.com/ca7ai/mcp-sec-scanner.git
cd mcp-sec-scanner
pip install -e .

Quick Start

1. Scan Local Code (Static Analysis)

poetry run mcp-scanner scan ./mcp-server/

# Output
================================================================================
MCP Security Scan Results: ./mcp-server/
================================================================================
Summary:
  Total Issues: 3
  By Severity:
    HIGH: 2
    CRITICAL: 1

[CRITICAL] PY003: Hardcoded AWS Access Key detected
  File: server.py:15:8
  Fix: Use environment variables or secret management

2. Probe Live Server (Runtime Analysis)

poetry run mcp-scanner probe http://localhost:3000

# Output
[HIGH] RT001: Found 2 tools with dangerous capabilities lacking constraints
[MEDIUM] RT002: Found 1 tools with potential prompt injection patterns

3. Verify Domain Ownership

poetry run mcp-scanner verify example.com

# Output
✅ DNS Verified: Yes
✅ DNSSEC Valid: Yes
Trust Level: MEDIUM

4. Full Audit (Combined)

poetry run mcp-scanner audit example.com --code ./server/

Usage

Static Code Scan

# Scan single file
poetry run mcp-scanner scan server.py

# Scan directory
poetry run mcp-scanner scan ./mcp-server/

# JSON output for CI/CD
poetry run mcp-scanner scan ./server/ --format json --output results.json

# Filter by severity
poetry run mcp-scanner scan ./server/ --min-severity high

Runtime Probe

# Probe HTTP server
poetry run mcp-scanner probe http://localhost:3000

# Save results
poetry run mcp-scanner probe http://localhost:3000 --output probe.json

Domain Verification

# Verify DNS/DNSSEC
poetry run mcp-scanner verify example.com

CI/CD Integration

# Scan fails build if issues found (exit code 1)
poetry run mcp-scanner scan ./server/ --format json --output security-report.json

Security Rules

Python Static Analysis (5 rules)

Rule ID	Severity	Detection
PY001	HIGH	Shell injection via `os.system()`, `subprocess.call(shell=True)`
PY002	HIGH	Path traversal with `../` patterns
PY003	CRITICAL	Hardcoded secrets (AWS keys, API tokens, passwords)
PY004	CRITICAL	Dangerous `eval()`, `exec()`, `compile()`
PY005	HIGH	Insecure deserialization (`pickle.loads`, `yaml.load`)

Runtime Checks (3 checks)

Rule ID	Severity	Detection
RT001	HIGH	Tools with dangerous capabilities (exec, shell, delete) lacking input validation
RT002	MEDIUM	Prompt injection patterns in tool descriptions
RT003	HIGH	Resource URIs exposing sensitive paths or path traversal

Architecture

mcp-sec-scanner/
├── src/mcp_scanner/
│   ├── core/              # Pydantic models, exceptions
│   ├── analyzers/         # Static analysis engines
│   │   └── static/        # Python AST analyzer
│   ├── runtime/           # Runtime security checks
│   │   ├── checks.py      # RT001-RT003 implementations
│   │   └── probe.py       # Runtime orchestrator
│   ├── transports/        # HTTP/WebSocket clients
│   │   └── http_client.py # MCP JSON-RPC over HTTP
│   ├── verification/      # DNS/DNSSEC verifier
│   ├── rules/             # Security rule definitions
│   ├── outputs/           # JSON and text formatters
│   └── cli.py             # Command-line interface
└── tests/                 # Unit and integration tests

Key Design Patterns:

Plugin System: Extensible rule engine with dependency resolution
Transport Abstraction: HTTP, WebSocket, stdio support
Immutable Models: Pydantic with frozen config for audit integrity
Fail-Safe Execution: One plugin failure doesn't stop entire scan

Development

Run Tests

poetry run pytest -v
poetry run pytest --cov=src/mcp_scanner

Type Checking

poetry run mypy src/mcp_scanner

Code Quality

poetry run black src/ tests/
poetry run ruff check src/ tests/

Roadmap

Phase 1 (Current)

✅ Python static analysis (5 rules)
✅ Runtime probing (3 checks)
✅ DNS/DNSSEC verification
✅ HTTP transport
✅ JSON + text output

Phase 2 (Planned)

Phase 3 (Future)

Unique Features:

Only scanner combining static, runtime, and verification
MCP-specific threat detection (not generic)
Trust scoring via cryptographic verification

License

PolyForm Noncommercial License 1.0.0

Summary:

✅ Free for noncommercial use
✅ Personal research and education
✅ Open source contributions
❌ Commercial use requires separate license

For commercial licensing inquiries, contact the maintainer.

Acknowledgments

Built for the Model Context Protocol ecosystem
Uses patterns from Bandit, Semgrep, and ESLint

Support

Issues: GitHub Issues
Discussions: GitHub Discussions
Security: Report vulnerabilities privately via GitHub Security Advisories

Name		Name	Last commit message	Last commit date
src/mcp_scanner		src/mcp_scanner
tests		tests
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
pyproject.toml		pyproject.toml

Latest commit

History

Folders and files

Repository files navigation