mcp-scan / check a package

Check any MCP server package.

Run mcp-scan's scanners against any npm-published MCP server before you add it to a client config. Get a shareable report and a badge for its README.

Try one
mcp-scan@modelcontextprotocol/server-filesystem@playwright/mcp

What it checks

  • Secrets and credentials leaked into server configs
  • Prompt injection hidden in tool names or descriptions
  • Supply-chain risk: typosquatting and low-trust packages

A real report.

The cached run on @modelcontextprotocol/server-filesystem: the grade, the counts, the README badge snippet, and the command to run the same scan yourself.