mcp-scan / rules reference
Every rule mcp-scan can raise.
66 rules, one page each: the exact pattern that triggers it, the cases where dismissing it is the right call, and the fix. These are the pages behind the helpUri links in every SARIF report the scanner writes. The scanner is free and MIT licensed on npm.
Critical · 10
- Blocked package policy
blocked-package-policy - Credential relay risk
credential-relay-risk - PII handling
data-controls-pii - Data exfiltration risk
data-exfiltration-risk - Exposed secret detected
exposed-secret - Known malicious package
known-malicious - Critical known vulnerability
known-vulnerability-critical - Python inline execution
python-inline-execution - Reverse shell risk
reverse-shell-risk - Shell injection risk
shell-injection-risk
High · 24
- Capability escalation
capability-escalation-risk - Encryption gap
data-controls-encryption-gap - Env file secret exposed
env-secret-exposed - Excessive permissions
excessive-permissions - Data exfiltration vector
exfiltration-vector - Hidden instructions
hidden-instruction-risk - HTTP transport without auth
http-transport-no-auth - Insecure transport
insecure-transport - High known vulnerability
known-vulnerability-high - License compliance risk
license-risk - Egress bypass attempt
network-egress-bypass-attempt - Data in URL
network-egress-data-in-url - Obfuscated endpoint
network-egress-obfuscated - Raw IP endpoint
network-egress-raw-ip - Suspicious network egress
network-egress-suspicious - Node inline execution
node-inline-execution - Prompt injection risk
prompt-injection-pattern - Sensitive glob pattern
sensitive-glob-pattern - Stale package
stale-server - Suspicious execution pattern
suspicious-execution - Tool exfiltration instructions
tool-exfiltration-risk - Potential typosquatting
typosquat-detection - Unicode injection
unicode-injection - Unverified package source
unverified-source
Medium · 17
- Broad filesystem access
broad-filesystem-access - Cross-server data flow
cross-server-flow - Consent gap
data-controls-consent-gap - Deletion gap
data-controls-deletion-gap - Prompt logging
data-controls-prompt-logging - Retention gap
data-controls-retention-gap - Duplicate server
duplicate-server - Env var scope leak
env-var-scope-leak - High-entropy value
high-entropy-value - Medium known vulnerability
known-vulnerability-medium - Missing referenced env var
missing-referenced-env-var - Non-standard port
network-egress-non-standard-port - Telemetry endpoint
network-egress-telemetry - Unknown external endpoint
network-egress-unknown - Server mutation
server-mutation - Low-trust supply chain
supply-chain-low-trust - Tool name shadowing
tool-name-shadow
Low · 9
- Data minimization risk
data-controls-minimization-risk - Stale temp files
data-controls-stale-temp-files - Env var prefix risk
env-var-prefix-risk - Low known vulnerability
known-vulnerability-low - Large argument list
large-arg-list - Outdated transport
outdated-transport - Scanner failure
scanner-error - Schema bypass risk
schema-bypass-risk - Windows path on Unix
windows-path-on-unix