mcp-security-scanner

Security auditing tool for MCP (Model Context Protocol) server deployments.

Scans your MCP servers for common security issues: exposed secrets, vulnerable dependencies, misconfigured authentication, dangerous code patterns, and more.

Why

MCP adoption is growing fast, but security tooling for production deployments doesn't exist. Developers deploying MCP servers today have no automated way to check whether their OAuth configuration leaks tokens, whether .env files are properly protected, or whether their tool implementations contain injection vectors.

This tool gives you an automated security baseline for any MCP server cluster.

Born from operating 10 MCP servers in production — every check exists because the vulnerability was found in a real deployment first.

Quick Start

pip install mcp-security-scanner

Scan a single MCP server:

mcp-scan check --target /path/to/your/mcp-server/

Scan with a config file (multiple servers):

mcp-scan check --config scan-config.yaml

Generate a Markdown report:

mcp-scan check --target /path/to/server/ --format markdown --output report.md

Checks

Check	What it finds	Severity
secrets	Hardcoded API keys, tokens, passwords, private keys in source code	High-Critical
env_files	.env permissions, .gitignore coverage, git history exposure	Medium-High
dependencies	Known CVEs in Python packages (via pip-audit), unpinned versions	Low-Critical
oauth	Token lifetime, wildcard scopes, disabled PKCE, redirect URI validation, verify=False	Medium-High
tls	Certificate validity/expiry, protocol version, cipher suites, HSTS, security headers	Medium-Critical
tunnel	Cloudflare Tunnel catch-all routes, exposed admin services, sensitive ports, nginx proxy config	Medium-High
mcp_config	eval()/exec() calls, debug mode, missing input validation, shell execution, stack trace leakage	Medium-Critical

Usage

Single target

# Table output (default)
mcp-scan check --target ./my-mcp-server/

# Only specific checks
mcp-scan check --target ./my-mcp-server/ --only secrets,dependencies

# JSON output
mcp-scan check --target ./my-mcp-server/ --format json

# Filter by severity
mcp-scan check --target ./my-mcp-server/ --min-severity high

Multiple targets via config

Create a scan-config.yaml:

targets:
  - name: "RAG Brain MCP"
    path: /opt/rag-mcp/
    url: https://rag.example.com/sse

  - name: "GSC MCP"
    path: /opt/gsc-mcp/
    url: https://gsc.example.com/sse

min_severity: low

report:
  format: markdown
  output: ./security-report.md

mcp-scan check --config scan-config.yaml

List available checks

mcp-scan list-checks

Exit codes

Code	Meaning
0	No findings
1	Findings found (medium or low)
2	Critical or high severity findings

Useful for CI/CD pipelines:

mcp-scan check --target . --min-severity high || echo "Security issues found!"

Optional: Dependency CVE scanning

For the dependencies check to scan for known CVEs, install with the audit extra:

pip install mcp-security-scanner[audit]

This installs pip-audit for vulnerability database lookups.

Example Output

Scanning: my-mcp-server (/opt/my-mcp/)
  Running secrets... 2 finding(s)
  Running env_files... 1 finding(s)
  Running dependencies... clean
  Running tls... clean
  Running mcp_config... 1 finding(s)

        Scan Summary
┌──────────────┬──────────┬──────┬────────┬─────┬───────┐
│ Target       │ Critical │ High │ Medium │ Low │ Total │
├──────────────┼──────────┼──────┼────────┼─────┼───────┤
│ my-mcp-server│ 1        │ 1    │ 1      │ 1   │ 4     │
└──────────────┴──────────┴──────┴────────┴─────┴───────┘

Contributing

See CONTRIBUTING.md for development setup and how to add new checks.

Security

See SECURITY.md for reporting vulnerabilities.

License

MIT