HEXIS MCP GUARD

Security scanner for MCP (Model Context Protocol) servers.

Install

pip install git+https://github.com/Noumenon-ai/hexis-mcp-guard.git

Or from source:

git clone https://github.com/Noumenon-ai/hexis-mcp-guard.git
cd hexis-mcp-guard
pip install -e ".[dev]"

Usage

hexis scan ./my-server/
hexis scan --format sarif -o results.sarif ./server/
hexis scan --format json ./server/
hexis scan --url http://localhost:8080 --dynamic
hexis scan ./server/ --ai
hexis scan ./server/ --ci --fail-on high
hexis scan ./server/ --baseline .hexis-baseline.json
hexis rules

Features

• 14 security rules (SSRF, shell injection, auth, prompt injection, resource exposure, transport)
• Static analysis + dynamic probing
• SARIF 2.1.0 output for GitHub Security tab
• JSON + rich terminal output
• CI/CD ready (exit codes)
• Optional AI reasoning (Claude)

Rules

CI/CD Integration

GitHub Actions

- name: MCP Security Scan
  run: |
    pip install git+https://github.com/Noumenon-ai/hexis-mcp-guard.git
    hexis scan ./src --format sarif --output results.sarif --ci --fail-on high

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Exit Codes

License

MIT

Built by Noumenon