mcplint

Local-first, CI-native security scanner for MCP servers. OWASP MCP Top 10 rules, a lockfile for rug-pull detection, and an AIBOM export. It never executes your MCP servers.

uvx mcplint-sec scan

PyPI distribution is mcplint-sec (the mcplint name collides with an existing project); the command it installs is mcplint.

Why

MCP went from a few hundred servers to a 10,000+ server ecosystem — and the security model did not keep up:

• ~40% of internet-exposed MCP servers have no authentication (Censys, 2026)
• A single compromised MCP server reaches a 78% attack success rate when five servers share one agent (arXiv 2601.17549)
• CVE-2025-6514 in mcp-remote (CVSS 9.6) affected a package with 437k+ downloads
• Registries accepted typosquatted MCP servers; tool descriptions are mutable after approval ("rug pulls")

Most scanners run on your machine and hand your tool descriptions to a vendor API. mcplint scans the configs in your repo, in CI, with nothing leaving your environment.

Quickstart

# scan the current repo
uvx mcplint scan

# also scan user-level client configs and skills
uvx mcplint scan --home

# pin server fingerprints, detect drift in CI
uvx mcplint lock
uvx mcplint lock --check

# CycloneDX AIBOM of every MCP server
uvx mcplint inventory -o aibom.json

# what do the rules mean?
uvx mcplint rules list
uvx mcplint rules explain MCP004

Exit code is 1 when a finding at --fail-on severity (default high) exists — drop it into CI as-is.

What it scans

Rules

Rules are data: plain YAML in src/mcplint/rules_data/. Bring your own with --rules-dir ./my-rules.

GitHub Actions

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v4
  - uses: dtduc-git/mcplint@main
    with:
      fail-on: high

Findings show up as annotations and in the repo's code-scanning tab (SARIF).

Design principles

1. Never executes your MCP servers. Scanning is static by default; running arbitrary server commands in CI is not acceptable.
2. Nothing leaves your machine unless you opt in with --online (OSV CVE lookups only).
3. Pin and diff. .mcplint.lock.json fingerprints every server (salted hashes for env values) so post-approval changes are visible in git diff.
4. Rules as data. YAML + a small, tested check engine — contributions do not need to touch the scanner core.
5. Non-goals: no gateway, no proxy, no runtime traffic monitoring, no SaaS.

Development

uv sync --all-groups
uv run pytest
uv run ruff check .
uv run mcplint scan fixtures/vulnerable-repo --fail-on none

License

Apache-2.0