MCP-scan

Active
GitHub Python Apache-2.0

Description

A security scanner from Invariant Labs that automatically detects prompt injection and vulnerabilities in MCP servers and agent skills.

Key Features

  • MCP protocol scan - Actively connects to MCP servers and audits tool descriptions for injection risks
  • Prompt-injection detection - Uses Invariant rulesets to surface indirect prompt injection
  • Security assertions - Ships a library of cross-platform agent security assertions for testing
  • CI integration - Runs as a pre-commit or GitHub Action gate
  • Detailed reports - Outputs risk levels, attack paths, and remediation advice in JSON/HTML

Use Cases

💡 Audit third-party MCP servers and agent skills across an organization
💡 Gate MCP tool changes behind CI security checks
💡 Evaluate the security posture of in-house agents against MCP tools
💡 Augment security teams with static auditing of tool descriptions and model outputs

Tags

mcp security scanning prompt-injection auditing

Categories

🛡️ Security & Guardrails 🔌 MCP Tools

Quick Start

# Install mcp-scan
pip install mcp-scan

# Scan a stdio MCP server
mcp-scan --stdio "npx -y @modelcontextprotocol/server-filesystem /tmp"

# Export the results as JSON
mcp-scan --stdio "..." --output report.json
Visit GitHub

Related Projects