mcpinspect

MCP security scanner. Offline-first. No telemetry. CI-native.

What makes it different from mcp-scan / Cisco mcp-scanner:

• Scans tool RESPONSES (not just descriptions) — catches the GitHub/Supabase class of attacks where poisoning hides in data, not metadata
• Rug-pull drift detection across the full session, not just on connect
• SARIF output for GitHub/GitLab Security tab integration
• Zero cloud dependencies — runs fully offline, your config never leaves your machine

Install

pip install mcpinspect

Usage

mcpinspect scan https://your-mcp-server.com
mcpinspect scan stdio:///usr/local/bin/my-mcp-server
mcpinspect audit                    # auto-discovers Claude/Cursor/Windsurf configs
mcpinspect audit ~/.cursor/mcp.json
mcpinspect diff https://... --interval 60   # watch for rug-pulls

# CI usage (exit code 2 = CRITICAL, blocks the build)
mcpinspect scan https://... --sarif > mcp-results.sarif

What it checks

GitHub Actions example

name: MCP Security Scan
on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      
    steps:
      - uses: actions/checkout@v4
      
      - name: Install mcpinspect
        run: pip install mcpinspect
        
      - name: Scan MCP Server
        run: mcpinspect scan stdio:///usr/local/bin/my-mcp-server --sarif > results.sarif || true
        
      - name: Upload SARIF report
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif
          category: mcpinspect

Limitations (be honest)

• Response checks require --probe (default on). If a tool errors on canary input, that tool's responses aren't checked. Use --probe-args to customize.
• Drift detection takes 20s extra (two-pass). Use --no-drift in fast CI.
• Pattern matching has false positives on documentation-heavy tool descriptions. Use --ignore-check MCI-D01 to suppress specific checks.
• Does not detect attacks that require semantic understanding of tool behaviour. For that, see Cisco mcp-scanner (LLM-assisted) or Snyk Agent Scan.