MCP security scanner / local evidence

Inspect the MCP configuration before it reaches a real workflow.

Name: mcp-scan
Author: ThynkQ

One local command for a concrete baseline. mcp-scan is MIT licensed, runs against your configuration, and sends no telemetry.

Check a package Book MCP Risk Review

$ npx mcp-scanCaptured with CLI v2.1.0 on 2026-10-10

CRITICAL exposed-secret

Exposed GitHub Token in environment variable 'WEATHER_TOKEN'.

↳ Move the secret to a secure environment variable and reference it instead (e.g., ${WEATHER_TOKEN}).

MEDIUM unverified-source

Server 'weather-demo-server' is an unscoped package from an unverified source (typosquatting risk).

↳ Verify the publisher of 'weather-demo-server' on npmjs.com before trusting this server, or ask the maintainer to publish with npm provenance (npm publish --provenance from GitHub Actions or GitLab CI) so mcp-scan can confirm it automatically.

Scanned 1 server across 1 client in 494ms

1 critical 0 high 1 medium 0 low

by Rodolf · thynkQ thynkq.com

Captured from a purpose-built synthetic MCP configuration. It does not inspect this page or your machine.

Open-source product record

Local evidence before a human decision.View source

License: MIT licensed
Open-source baseline
Execution: Runs locally
Inspect your configuration
Telemetry: None
No scan runs on this page
Coverage: 16 scanners
17 supported clients and tools

The critical finding from the capture above, then the one-line fix: the token leaves mcp.json and becomes an environment variable reference.

Start here in under a minute

Choose the path that matches your MCP risk right now.

Pick the path that matches the decision you need to make before you go deeper.

Routing path

Check rollout risk in under a minute

Best when you are not sure whether the next move should stay self-serve, become a hosted artifact, or jump straight into a paid founder review.

Run MCP calculator

Product path

Preview an exportable report format

Best when you need a cleaner summary than raw terminal output and want to assess whether a hosted report fits your workflow.

Preview hosted report

Paid path

Reserve the MCP Risk Review

Best when rollout is close, permissions are sensitive, and a fast human decision is worth more than reading scanner output alone.

Book MCP review

Hosted report preview

See the report before you join the waitlist.

A sample of the hosted report: a decision summary, the highest-risk findings, and an export a team can share internally without rewriting raw scanner output by hand.

sample hosted report

MCP rollout summary

Fix before rollout

Affected surfaces: 2 MCP servers
Export bundle: Summary + policy notes
Best path: Pro report or human review

HIGHFilesystem connector can exfiltrate secrets

A shell-capable connector can read local secrets and reach an external host with no approval boundary.

Shortest safe next stepRestrict permissions, pin the server source, and block unrestricted egress before rollout.

MEDIUMUnverified package origin in MCP server chain

The server definition points to a package path that is not pinned to a trustworthy release boundary.

Shortest safe next stepPin the package source and record a known-good version before teammates reuse it.

MEDIUMPrompt boundary missing on high-trust tool

One tool can receive unconstrained instructions without a clear human-review checkpoint.

Shortest safe next stepAdd a review gate and narrow the tool contract before connecting it to sensitive workflows.

Join the mcp-scan Pro waitlist

Hosted reports, policy packs, and shareable risk summaries are being explored for teams that need a shareable decision artifact after a local scan. This form is the waitlist, not a purchase.

Paid next step

MCP Risk Review

Best for teams comparing a lightweight hosted report against the human review lane (48 hours from access), where a person verifies whether the current setup is safe enough to ship.

$3,000 fixed scope48 hours from access

Request MCP Risk Review Book a free MCP Risk Review call

Reserve the narrow lane if the MCP problem is already clear. If the risk is broader than one MCP decision, escalate into a Build Readiness Audit instead of forcing this fixed-scope review. See the full lane details.

Defense in Depth

16 scanners. 17 supported AI clients and tools. One command.

mcp-scan provides a unified security layer for the Model Context Protocol ecosystem. Run it locally or integrate with your CI/CD pipeline.

6 of the 16 specialized scanners

v2.3.0

Run locally for configuration-specific findings.
Scanner module	What it finds	Severity
Secrets Detection`secret-scanner`	Entropy-based scanning for API keys and tokens.	High
Package Audit`package-scanner`	Audits package manifests and dependency hygiene.	High
Prompt Injection`prompt-injection-scanner`	Analyzes prompts for potential injection vectors.	High
Tool Poisoning`tool-poisoning-scanner`	Detects malicious tool definitions and schemas.	High
Supply Chain`supply-chain-scanner`	Verifies the trust chain of connected MCP servers.	Medium
Data Controls`data-controls-scanner`	Audits PII handling, retention gaps, and privacy control coverage.	Medium

And 10 more scanners in the source

How it works

Three steps to secure your AI tools

Install

npm install -g mcp-scan or run instantly with npx. No setup required.

Scan

Automatically detects 17 supported AI clients and tools, including Claude, Cursor, and VS Code.

Fix

Detailed findings with severity levels and remediation steps.

17 supported AI clients and tools

mcp-scan works across desktop apps, editors, CLIs, and coding tools that expose Model Context Protocol configurations.

Claude Desktop

Claude Code

Cursor

VS Code

Windsurf

Zed

Gemini CLI

Codex CLI

Continue.dev

Amp

Plandex

ChatGPT Desktop

GitHub Copilot

Cline

Roo Code

Kiro

Warp

CI/CD Ready

SARIF for any CI pipeline

Runs in any pipeline with one npx command. Outputs SARIF 2.1.0 for native integration with GitHub Advanced Security and other security dashboards.

SARIF 2.1.0GitHub Advanced Security

.github/workflows/security.yml

- name: MCP Security Scan  run: npx mcp-scan@latest --sarif mcp-scan.sarif- name: Upload SARIF  uses: github/codeql-action/upload-sarif@v3  with:    sarif_file: mcp-scan.sarif

The mcp-scan check surface: a package name field, the Check package button, and the three checks it runs before a server is added to a client config.

v2.3.0 · MIT LICENSE

Secure by default. Open by design.

mcp-scan is free, open source, and built for the community. Zero telemetry. No vendor lock-in. The full test suite runs in the public repo on every change.

16Scanners17 named finding types

0Telemetrynothing phones home

17AI Toolssupported

2,399Downloadslast 30 days, live from npm

Abanoub-Rodolf/mcp-scanMIT Licensed Open Source

Star on GitHub View Repo

npm install -g mcp-scan

npx mcp-scan

mcp-scan · MIT licensed · Source and install stats public on npm · Read: The State of MCP Security

FAQ

mcp-scan, answered directly.

What is mcp-scan?

mcp-scan is an open-source security scanner for Model Context Protocol (MCP) server configurations. It detects leaked secrets, prompt injection risks, supply-chain vulnerabilities, and misconfigurations across 17 supported AI clients and tools, including Claude Desktop, VS Code, Cursor, and Windsurf.

How do I run mcp-scan?

Run `npx mcp-scan@latest` in your terminal. No installation required. It automatically detects and scans all AI tool configurations on your system.

Is mcp-scan free?

Yes. mcp-scan is completely free and open-source under the MIT license. It has zero telemetry and collects no data.

What security checks does mcp-scan perform?

mcp-scan runs 16 scanners with 17 named finding types across secret detection, prompt injection scanning, supply chain risk analysis, typosquatting detection, data flow analysis, network egress monitoring, and compliance mapping (SOC 2, GDPR, HIPAA).