MCP Scanner

Security scanner for MCP (Model Context Protocol) servers. Detect malicious tools, data exfiltration, and supply chain risks before connecting an MCP server to your AI agent.

Why MCP Scanner?

MCP servers give AI agents (Claude Code, Cursor, Copilot) direct access to tools, filesystems, and APIs. But nobody is checking if those servers are safe.

MCP Scanner analyzes:

• MCP server config files (Claude Code, Cursor, generic)
• Command-level risks (npx --yes, curl|bash, sudo)
• Secret exposure in environment variables
• Filesystem and network access patterns
• Source code of MCP server implementations (with AgentGuard integration)

Quick Start

pip install dfx-mcp-scanner

# Scan your Claude Code MCP config
mcp-scanner

# Scan a specific config
mcp-scanner ~/.cursor/mcp.json

# JSON output
mcp-scanner .mcp.json --format json

What It Detects

Supported Configs

• Claude Code (~/.claude/claude_code_config.json)
• Cursor (~/.cursor/mcp.json)
• Project-level (.mcp.json)
• Generic MCP server configs

AgentGuard Integration

When AgentGuard is installed, MCP Scanner performs deep source code analysis on MCP server implementations using all 10 OWASP ASI detection rules.

License

MIT - see LICENSE.

Built by Dockfix Labs.

AgentGuard Ecosystem

AgentGuard is the core security scanner. Companion tools:

19 detection rules | 102 tests | 50 benchmark samples | OWASP ASI Top 10 GitHub Action: dockfixlabs/agentguard@v1