MCPCheck 🔒

MCP supply chain security scanner. Detect tool poisoning, prompt injection, data exfiltration, and other attacks in MCP server definitions.

Installation

pip install mcpcheck

Usage

Basic scan

mcpcheck ./my-mcp-server

JSON output

mcpcheck ./my-mcp-server --format json

SARIF for CI/CD

mcpcheck ./my-mcp-server --format sarif > results.sarif

Severity filter

mcpcheck ./my-mcp-server --min-severity HIGH

Exclude patterns

mcpcheck ./my-mcp-server --exclude "vendor/*" --exclude "node_modules/*"

Detected Vulnerabilities

Exit Codes

CI/CD Integration

MCPCheck includes a GitHub Action (action.yml) for seamless CI/CD integration. It runs a scan, uploads results as a SARIF artifact, and integrates with GitHub Code Scanning.

name: MCPCheck Scan
on:
  push:
    branches: [main]
  pull_request:

jobs:
  mcpcheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run MCPCheck
        uses: onicarps/MCPSafe@main
        with:
          path: "."
          severity: "LOW"
          version: "0.1.0"

      # The action automatically uploads SARIF results to GitHub Code Scanning.
      # Findings will appear under the "Security" tab in your repository.

You can also invoke MCPCheck directly in any CI pipeline:

pip install mcpcheck
mcpcheck ./my-mcp-server --format sarif > results.sarif

License

MIT