Audit MCP servers against the OWASP MCP Top 10. The only open-source scanner that actually connects to running servers.
There are 8,500+ MCP servers in the ecosystem. 38% lack authentication entirely. 30 CVEs were filed in 60 days. The existing tools either phone home to proprietary APIs (Snyk) or only analyze static config files without ever connecting to the server.
This tool connects to your MCP servers via the standard protocol, retrieves actual tool definitions, and scans them for security issues. Everything runs locally. No API keys. No data leaves your machine.
| Category | Check | Mode |
|---|---|---|
| MCP01 Token Mismanagement | Credentials in args, env vars, URLs | Static + Dynamic |
| MCP02 Privilege Escalation | Dangerous tool combinations (exec + network, file + network) | Dynamic |
| MCP03 Tool Poisoning | Hidden instructions in descriptions, name shadowing | Dynamic |
| MCP04 Supply Chain | Unpinned packages, auto-install flags | Static |
| MCP05 Command Injection | Shell execution patterns, injectable parameters | Dynamic |
| MCP06 Prompt Injection | Parameters accepting prompt-like content | Dynamic |
| MCP07 Authorization Failures | Destructive tools, unrestricted access scope | Dynamic |
| MCP08 Insufficient Telemetry | Missing logging capability | Dynamic |
| MCP10 Context Oversharing | Sensitive parameters exposed to LLM context | Dynamic |
Static checks analyze your mcp.json config without launching servers.
Dynamic checks connect to running servers, retrieve tool definitions, and analyze them.
pip install -e .Requires Python 3.10+ and the mcp SDK.
mcp-scan --config ~/.claude/mcp.jsonmcp-scan --command npx @modelcontextprotocol/server-filesystem /tmpmcp-scan --automcp-scan --static ~/.claude/mcp.jsonmcp-scan --config mcp.json --format json| Code | Meaning |
|---|---|
| 0 | No high/critical findings |
| 1 | High severity findings |
| 2 | Critical severity findings |
Use in CI: mcp-scan --config mcp.json --format json || echo "Security issues found"
============================================================
MCP Security Scan Report
OWASP MCP Top 10 Audit
============================================================
Server: my-filesystem-server
Name: filesystem
Version: 1.0.0
Protocol: 2025-03-26
Tools: 5
Tool list:
- read_file: Read complete contents of a file
- write_file: Create or overwrite a file
- list_directory: List directory contents
- delete_file: Delete a file from the filesystem
- execute_command: Execute a shell command
Findings (4):
[HIGH] Server has both code execution and filesystem access
Category: MCP02: Privilege Escalation
Detail: Combining execution and filesystem tools enables arbitrary file manipulation
Fix: Sandbox execution tools. Restrict filesystem access paths.
[HIGH] Command injection risk: Shell metacharacters in string
Category: MCP05: Command Injection
Tool: execute_command
Detail: Tool 'execute_command' description suggests shell execution
Fix: Avoid passing user input to shell commands.
[MEDIUM] Destructive tool detected
Category: MCP07: Authorization Failures
Tool: delete_file
Fix: Mark destructive tools with destructiveHint: true.
[MEDIUM] Unpinned npm package: @modelcontextprotocol/server-filesystem
Category: MCP04: Supply Chain
Fix: Pin to a specific version: e.g., package@1.2.3
------------------------------------------------------------
SUMMARY
Servers scanned: 1
Total findings: 4
HIGH: 2
MEDIUM: 2
RESULT: HIGH severity issues found. Review and remediate.
| Tool | Dynamic | Open Source | Local Only |
|---|---|---|---|
| mcp-security-scan | Yes | Yes | Yes |
| Snyk Agent Scan | Yes | Partial* | No (phones home) |
| MCPSec | No (static) | Yes | Yes |
| mcp-security-scan (cc-fuyu) | No (static) | Yes | Yes |
*Snyk's scanner is Apache-2.0 but requires a proprietary API for analysis.
Found a check that should exist? Open a PR. Each check should:
- Map to an OWASP MCP Top 10 category
- Have clear severity assignment logic
- Include remediation guidance
- Work with real server output, not just test fixtures
MIT