mcp-scan

Overview

MCP-Scan operates in two main modes: static scanning of installed MCP servers for malicious tool descriptions and tools, and real-time monitoring of MCP connections through a proxy. It can detect various security threats including prompt injections, tool poisoning attacks, toxic flows, and cross-origin escalation attempts. The tool integrates with Invariant Guardrails to provide customizable security policies that can enforce data flow constraints, PII detection, and custom validation rules.

Try asking AI

After installing, here are 5 things you can ask your AI assistant:

• scan

  Scan MCP configurations for security vulnerabilities in tools, prompts, and resources

  Try:Scan all my MCP servers for security vulnerabilitiesTry:Check my Claude configuration for tool poisoning attacks
• proxy

  Run a proxy server to monitor and guardrail system-wide MCP traffic in real-time

  Try:Start monitoring my MCP connections for suspicious activityTry:Enable proxy mode to guardrail all MCP traffic
• inspect

  Print descriptions of tools, prompts, and resources without verification

  Try:Show me all the tools in my MCP configurationTry:List all available resources from my GitHub MCP server
• whitelist

  Manage the whitelist of approved entities for MCP tools, prompts, and resources

  Try:Add a tool to the whitelistTry:Show me all whitelisted entities

Note: Tools extracted from CLI command structure, as the README doesn't explicitly document MCP tools but rather CLI commands that would interact with MCP tools

Comparable tools

Installation

pip install mcp-scan

uvx mcp-scan@latest scan

mcp-scan proxy

FAQ

What types of vulnerabilities does MCP-Scan detect?

MCP-Scan detects prompt injection attacks, tool poisoning attacks, toxic flows, cross-origin escalation attacks, and MCP rug pull attacks. It can also detect and block PII and secrets in tool outputs.

Does MCP-Scan share my data with external services?

For static scanning, tool descriptions are shared with Invariant Labs for security research purposes (not your user data). You can opt out using the --opt-out flag. The proxy mode operates entirely locally without external API calls.

Compare mcp-scan with