mcpsec

概述

mcpsec 是专门为测试 MCP 服务器设计的 AI 驱动安全工具。它结合静态分析和动态运行时测试，以识别 SSRF、LFI、命令注入和其他漏洞。该工具已在真实的 MCP 服务器中发现多个关键 CVE，并通过扫描器、模糊测试器和 AI 生成的有效载荷提供全面的测试。它支持多种连接方式（stdio、HTTP），并通过 SARIF 输出与 CI/CD 管道良好集成。

试试问 AI

装完之后，这里有 7 个你可以让 AI 做的事：

• scan

  Scan MCP servers for security vulnerabilities via stdio or HTTP

  试试:Scan my MCP server via stdio试试:Scan an HTTP MCP server with authentication
• audit

  Perform static analysis on MCP server source code

  试试:Audit my local MCP server implementation试试:Audit an MCP server from a GitHub repository
• fuzz

  Perform protocol fuzzing on MCP servers to discover crashes

  试试:Fuzz my MCP server with standard test cases试试:Fuzz with high intensity test cases
• sql

  Scan MCP servers for SQL injection vulnerabilities

  试试:Test my MCP server for SQL injection试试:Scan a MySQL server for SQL injection
• chains

  Detect dangerous tool combinations in MCP servers

  试试:Check for dangerous tool chains in my server试试:Find potentially harmful tool combinations
• exploit

  Start an interactive exploitation session for MCP servers

  试试:Start exploitation session for my vulnerable MCP server试试:Interact with a known vulnerable server
• rogue-server

  Run a rogue MCP server for client-side testing

  试试:Start a rogue server on port 9999试试:Run a server with all attack vectors enabled
• info

  Enumerate the attack surface of an MCP server

  试试:Get information about my MCP server's capabilities试试:List all tools exposed by my server
• setup

  Configure AI provider settings for enhanced scanning

  试试:Set up AI provider for enhanced scanning试试:Configure OpenAI API for mcpsec
• prompt-injection

  Scan for prompt injection vulnerabilities in tool descriptions

  试试:Check my server for prompt injection in tool descriptions试试:Scan for hidden instructions in tool prompts
• auth-audit

  Audit MCP servers for authentication issues

  试试:Check my server for authentication problems试试:Audit my MCP server for dangerous tool combinations
• capability-escalation

  Detect undeclared capability abuse in MCP servers

  试试:Check for capability escalation in my server试试:Scan for undeclared capability abuse

说明：Inferred from CLI command examples and scanner descriptions in the README. The server appears to expose these as MCP tools based on command usage patterns.

可对比工具

安装

# 基本安装
pip install mcpsec

# 带 AI 功能的安装
pip install mcpsec[ai]

# 通过 Nix 安装
nix-shell   # 基本版
nix-shell --arg withAll true   # 所有可选依赖

{
  "mcpServers": {
    "mcpsec": {
      "command": "python",
      "args": ["-m", "mcpsec", "stdio"]
    }
  }
}

FAQ

mcpsec 与其他静态分析工具有何不同？

mcpsec 专注于对实时服务器进行动态测试，证明可利用性而不仅仅是识别潜在漏洞。它还提供 AI 生成的有效载荷和全面的模糊测试功能。

mcpsec 是否适用于所有 MCP 服务器？

是的，mcpsec 适用于任何通过 stdio 或 HTTP 实现标准协议的 MCP 服务器。它支持身份验证方法，并且可以自动发现本地服务器。

如何报告我用 mcpsec 发现的漏洞？

mcpsec 提供负责任的披露选项。关键发现应首先报告给受影响的项目维护者，并在修复实施后协调公开披露。

mcpsec 对比