An MIT-licensed open-source security-scanning MCP server focused on AI-agent-specific risks, including prompt injection, MCP tool poisoning, package hallucinations, unsafe agent actions, and vulnerable generated code. The source confirms stdio transport and initialization commands for multiple clients, but does not provide a standalone authentication configuration example.
Agent Security Scanner MCP Server is a stdio MCP server that checks code, MCP tools, prompts, and dependencies before an AI agent trusts them. It provides code and repository scanning, MCP server audits, prompt-injection detection, agent-action safety checks, package hallucination detection, SBOM and vulnerability scanning, compliance evidence evaluation, and auto-fix capabilities. Rule-based CLI and MCP scans run locally; semantic review uses the provider selected by the user.
Run npx agent-security-scanner-mcp init claude-code, replacing claude-code with cursor, claude-desktop, windsurf, cline, kilo-code, opencode, or cody. Restart the client afterward. You can also run npx agent-security-scanner-mcp init to use the interactive picker.