Best for
- Security teams needing to ensure the security of MCP servers.
- Developers checking for vulnerabilities in MCP servers before deployment.
- Organizations looking to integrate security scanning into CI/CD pipelines.
M
MCP Scanner
Official
Scan MCP servers for potential threats & security findings.
GitHub source repository ↗
44FMRS · D
MCP Scanner is a comprehensive security scanning tool for MCP servers. It offers multiple analysis engines and rich features, but may require some configuration for full use.
MCP Scanner is a Python tool designed to scan MCP (Model Context Protocol) servers and tools for potential security findings. It leverages three powerful scanning engines: YARA rules, LLM-as-a-judge, and Cisco AI Defense inspect API, which can be used together or independently. The scanner supports multiple modes including a CLI tool and a REST API server, and offers features such as multi-engine security analysis, vulnerable package scanning, readiness scanning, behavioral code scanning, VirusTotal binary malware scanning, PyPI package scanning, static/offline scanning, and more. It is suitable for developers and security teams looking to ensure the security of MCP servers.
Tools
The tool list has not been reviewed yet.
Setup
Install using uv:
uv tool install --python 3.13 cisco-ai-mcp-scannerOr install from source:
git clone https://github.com/cisco-ai-defense/mcp-scanner
cd mcp-scanner
uv sync --python 3.13Fit and risk
Not for
- People looking for an MCP server implementation or client.
- Users needing real-time monitoring or active defense solutions.
- Organizations with strict privacy requirements regarding commercial APIs or external services.
Required permissions
- Requires access to Cisco AI Defense API key (optional).
- Requires an LLM provider API key (optional, for LLM analyzer).
- Requires a VirusTotal API key (optional, for malware scanning).
Risks and side effects
- Relies on external API services, which may raise data privacy concerns.
- Scanning may produce false positives or negatives.
- Requires proper configuration of environment variables; otherwise, may fail to run.
Troubleshooting
- Ensure Python 3.11+ and uv are installed.
- Check that environment variables are set correctly: MCP_SCANNER_API_KEY, MCP_SCANNER_LLM_API_KEY, etc.
- For remote servers, verify the server URL is accessible and authentication is configured correctly.
Use cases
Scan MCP servers' tools, prompts, resources, and instructions for security findings before deployment.
Scan offline JSON files in CI/CD pipelines for static security analysis.
Analyze MCP server source code for malicious behavior.
Scan PyPI or npm packages for hidden malicious behavior.
Supported clients
Supported clients have not been confirmed yet.