Sponsor MCPSafe10 founding slots
MCPSafe
Registry/Scanner MCP Server

Scanner MCP Server

Verified

MCP Scanner — 12 security checks for MCP server configurations. SARIF output.

MIT
other
other
1stars
Scanned Oct 2, 2026
WebsiteRepositoryGITHUB
mcpmodel-context-protocolartifact-recovered
Automated scan (limited checks) · 2026-10-02

This grade comes from an automated MCPSafe scan of the server's JavaScript, TypeScript and Python source on 2026-10-02. It read the whole repository (9 files). It checks for leaked credentials, shell or code injection from function inputs, unsafe deserialization, malware signatures, install-time scripts, and weak password handling. It does not check for path traversal, server-side request forgery, prompt injection in tool descriptions, network exposure, SQL injection, cross-site scripting, or vulnerable dependencies. It has not been manually reviewed, and the code may have changed since the scan.

A+100%
Scanned 1w ago

Excellent Security

Vulnerabilities Found
0Crit
0High
0Med
0Low
0Info

Trust Score 72

Review required
Trust grade B

Trust is stricter than security: it combines reviewed security, MCP capability risk, supply-chain metadata, quality, popularity, freshness, and penalties for unknowns.

Security
100
MCP risk
42
Supply chain
92
Maintenance
55
Docs
100
Freshness
80
Risk traits
Runs shell commands
Filesystem access
Network/API access
Requires secrets
Remote transport
Why it scores well
  • • No reviewed severe vulnerabilities published
  • • Good documentation surface
  • • Solid supply-chain metadata
  • • Recently scanned
What reduces confidence
  • • MCP risk traits: Runs shell commands, Filesystem access, Network/API access

Security ScoreA+

100
out of 100

Vulnerabilities Found

0
Crit
0
High
0
Medi
0
Low
0
Info
Last scanned: 10/2/2026

Quality ScoreC

60
out of 100
55
Maint.
3
Popular
100
Docs
72
Compat
Maintenance55%
Popularity3%
Documentation100%
Compatibility72%

Maintenance55

Unknown
Commit Frequency65%
Release Frequency35%
Issue Response65%

Popularity3

1
Stars
0
Downloads
0
Forks
Stars Score8%
Downloads Score0%
Forks Score0%

Documentation100

README Quality100%

Available Documentation

API DocsExamplesChangelog

Compatibility72

MCP Spec Compliance80%
Transport Support75%

Features

TypeScript

Supported Transports

STDIO

Vulnerabilities(0)

This grade comes from an automated scan. Individual findings from automated scans are not published.

READMEScanner MCP Server

View source

MCP Scanner

Security scanner for MCP (Model Context Protocol) servers. Detect malicious tools, data exfiltration, and supply chain risks before connecting an MCP server to your AI agent.

![PyPI](https://pypi.org/project/dfx-mcp-scanner/)

![Python 3.10+](https://python.org)

![License: MIT](LICENSE)

![CI](https://github.com/dockfixlabs/mcp-scanner/actions)

Why MCP Scanner?

MCP servers give AI agents (Claude Code, Cursor, Copilot) direct access to tools, filesystems, and APIs. But nobody is checking if those servers are safe.

MCP Scanner analyzes:

  • MCP server config files (Claude Code, Cursor, generic)
  • Command-level risks (npx --yes, curl|bash, sudo)
  • Secret exposure in environment variables
  • Filesystem and network access patterns
  • Source code of MCP server implementations (with AgentGuard integration)

Quick Start

bash
pip install dfx-mcp-scanner

# Scan your Claude Code MCP config
mcp-scanner

# Scan a specific config
mcp-scanner ~/.cursor/mcp.json

# JSON output
mcp-scanner .mcp.json --format json

What It Detects

| Rule | Severity | Description |

|------|----------|-------------|

| Remote code execution | CRITICAL | curl | bash patterns in server startup |

| Auto-install packages | HIGH | npx --yes without version pinning |

| Privileged execution | CRITICAL | Server running as root/sudo |

| Secret exposure | CRITICAL | Real API keys/tokens in config env vars |

| Host filesystem access | HIGH | Server accessing /etc, /root, /proc |

| External network access | MEDIUM | Server connecting to non-localhost URLs |

| Excessive tool count | LOW | Server registering >20 tools |

Supported Configs

  • Claude Code (~/.claude/claude_code_config.json)
  • Cursor (~/.cursor/mcp.json)
  • Project-level (.mcp.json)
  • Generic MCP server configs

AgentGuard Integration

When AgentGuard is installed, MCP Scanner performs deep source code analysis on MCP server implementations using all 10 OWASP ASI detection rules.

License

MIT - see LICENSE.

Built by Dockfix Labs.

AgentGuard Ecosystem

[AgentGuard](https://github.com/dockfixlabs/agentguard) is the core security scanner. Companion tools:

| Tool | Purpose | Install |

|------|---------|---------|

| agentguard | AI agent code security scanner | pip install dfx-agentguard |

| mcp-scanner | MCP server security audit | pip install dfx-mcp-scanner |

| agentguard-app | GitHub App for PR reviews | Install from Marketplace |

| agentguard-vscode | VS Code inline diagnostics | Install from VS Code |

| agentguard-benchmark | Detection benchmark suite | git clone |

| agentguard-demo | Live demo with Code Scanning | git clone |

19 detection rules | 102 tests | 50 benchmark samples | OWASP ASI Top 10

GitHub Action: dockfixlabs/agentguard@v1

Embed Security Badge

Add this badge to your README or documentation

Scanner MCP Server MCPSafe Security
[![Scanner MCP Server MCPSafe Security](https://api.mcpsafe.org
/api/badge/scanner-mcp-server.svg)](https://mcpsafe.org/registry/scanner-mcp-server)
Need more customization options?Badge Documentation

Server Information

Source
GITHUB
Language
other
License
MIT
Transport
STDIO
Added
Aug 11, 2026
Updated
Oct 1, 2026

Actions

Compare with other serversRequest rescan