🩺 mcp-doctor

Offline security scanner for MCP servers.
Detects tool poisoning, credential exposure, and dangerous permissions — before you connect.

pip install mcp-doctor
mcp-doctor scan

Why

The MCP ecosystem grew to 10,000+ servers in 18 months. Most developers connect servers without any security review. Meanwhile:

• Tool poisoning hides malicious instructions in tool descriptions that the AI reads but the user never sees (MCPTox, AAAI 2026)
• 24,008 secrets were found in public MCP config files (GitGuardian, 2026)
• CVE-2025-54136 showed shared-repo MCP configs can be weaponized across teams

mcp-doctor scans your MCP configs locally and offline — nothing leaves your machine.

What it checks

Usage

# Auto-detect configs (Claude Desktop, Cursor, VS Code, project-level)
mcp-doctor scan

# Scan a specific config file
mcp-doctor scan path/to/config.json

# JSON output (for CI pipelines)
mcp-doctor scan --output json

# Search a project directory for MCP configs
mcp-doctor scan --dir /path/to/project

Example output

🩺 mcp-doctor scan report
Config: ~/.config/Claude/claude_desktop_config.json
Servers scanned: 4

🔴 CRITICAL  TP-001  evil-server    Prompt injection in tool description
🔴 CRITICAL  CE-001  leaky-server   Hardcoded Anthropic API key
🔴 CRITICAL  DP-001  shell-access   Shell execution access
🟠 HIGH      CE-002  leaky-server   Secret in env: OPENAI_API_KEY
🟠 HIGH      TS-001  unsafe-remote  Unencrypted HTTP transport

  CRITICAL 3 | HIGH 2

  FAIL — critical findings require action.

CI Integration

mcp-doctor exits with code 1 when critical findings are present:

# .github/workflows/mcp-check.yml
- run: pip install mcp-doctor
- run: mcp-doctor scan --output json > mcp-report.json

Privacy

• Fully offline — no API calls, no telemetry, no data sent anywhere
• Config contents are analyzed in-process and never written to disk
• Unlike some alternatives, your tool schemas are never sent to external servers

License

MIT