mcp-scan

Security scanner for AI Agents and MCP servers. Detects prompt injection, tool poisoning, and data leakage; features runtime proxy protection and CI/CD integration.

Overview#

mcp-scan (now part of Snyk, originally developed by Invariant Labs AG) is a CLI tool focused on the security of the MCP (Model Context Protocol) ecosystem. It automatically discovers and scans local MCP configurations and agent skill files, leveraging static analysis and runtime proxy technology to identify various security threats.

Current Version: 0.4.2
License: Apache-2.0
Primary Language: Python (91.6%)

Core Security Detection Capabilities#

MCP Security Vulnerability Detection#

Prompt Injection Attacks
Tool Poisoning Attacks
Toxic Flows Analysis
Cross-origin Escalation / Tool Shadow Attacks
MCP Rug Pulls

Agent Skill Review#

Prompt injection attack detection
Malicious payload detection
Sensitive data handling identification
Hardcoded secrets detection

Runtime Protection Capabilities#

Proxy Mode (mcp-scan proxy)#

Real-time MCP traffic monitoring
Tool call inspection and blocking
Data flow constraint validation
PII detection
Indirect prompt injection protection

Guardrails Features#

Secret detection and interception
Tool usage restrictions
Custom guardrails policies (YAML configuration)
Local rule execution (privacy-preserving)

Auto-Discovery Support#

Automatically discovers MCP configurations for:

Claude Code / Claude Desktop
Cursor
Gemini CLI
Windsurf

Quick Start#

# Full system scan (auto-discover agents, MCP servers, skills)
uvx mcp-scan@latest --skills

# Scan specific config file
uvx mcp-scan@latest ~/.vscode/mcp.json

# Run proxy mode
uvx --with "mcp-scan[proxy]" mcp-scan@latest proxy

Main Commands#

Command	Function
`scan`	Scan config files, supports `--skills`, `--json`, `--full-toxic-flows` options
`proxy`	Start proxy server for real-time monitoring
`inspect`	View tool description details (no security checks)
`whitelist`	Manage whitelist (view/add/reset)

Requirements#

Python >= 3.10
uv package manager recommended

Project Background#

Developer: Invariant Labs AG (acquired by Snyk, June 2025)
Contribution Policy: Currently closed to external contributions
Deep Analysis: Depends on Invariant Guardrails cloud API