mcpvuln

A vulnerability scanner for Model Context Protocol codebases that proves how often it is wrong.

MCP lets an agent discover and call tools at runtime, from servers somebody else operates. That moves the unit of trust from a single function call to a whole protocol session, and the failures that follow have no equivalent in ordinary application security: forged agent identities, trust scores computed but never enforced, audit logs that can be rewritten, one tenant's context served to another.

There are scanners already. What none of them ships is a way to tell how much of the output is real, because they are only ever evaluated against code known to be broken. This one ships a benign control corpus as well, so precision is measured rather than assumed.

pip install mcpvuln

Try it in thirty seconds

git clone https://github.com/DINAKAR-S/Agentic-MCP-Scanner
mcpvuln Agentic-MCP-Scanner/demo/vulnerable   # 20 findings, 12 categories, all four layers
mcpvuln Agentic-MCP-Scanner/demo/safe         # 0 findings

The repository ships the same MCP server twice, with every vulnerability in the first one fixed in the second. The second command is the one that matters: any scanner finds planted bugs, but one that also fires on the corrected version is not measuring anything.

No API key. No network. Under a second.

Measured, not claimed

Precision, recall and F1 against a public ground truth of 22 documented vulnerabilities (benchmark/score_demo.py):

False positives on 285,463 lines of clean, officially maintained MCP code, where every finding is a candidate false positive (benchmark/):

A 96-fold reduction from 0.1.0, with fourteen more rules than 0.2.0. CI fails the build if that rate rises above 0.05. The 2025-2026 CVE classes are scored on a second public corpus, demo/vulnerable-2026 (16 instances, 16 detected, 0 false positives on the fixed half), kept separate so the 22-instance paper corpus above stays frozen.

Usage

mcpvuln ./my-mcp-server                    # offline, no API key needed
mcpvuln https://github.com/org/repo        # ingest from GitHub
mcpvuln ./repo --json scan.json            # emit the scan contract
mcpvuln ./repo --min-confidence 0.7        # tighten the threshold
mcpvuln ./repo --fail-on high              # exit non-zero, for CI
mcpvuln --self-check                       # validate the rule set

Detection needs no credentials. No GOOGLE_API_KEY, no OPENAI_API_KEY, no network. Only the optional --narrative and --threat-intel reach out, and both degrade to a warning without their key.

Extras

pip install "mcpvuln[github]"      # scan a GitHub URL directly
pip install "mcpvuln[narrative]"   # model-written analyst commentary
pip install "mcpvuln[intel]"       # external advisory lookup
pip install "mcpvuln[all]"         # all of the above

What it detects

44 rules across four layers, each carrying a confidence prior and CVSS v4.0 base metrics. Fourteen of them mirror MCP vulnerabilities published as CVEs in 2025 and 2026 (SSRF from a tool's URL argument, argument injection into git, DNS-rebinding protection disabled, all-interface binds, shared HTTP transports, line jumping, tool shadowing, invisible Unicode); the mapping is in docs/cve-coverage.md.

How it works

ingest  ->  detect  ->  score  ->  report

• detect is deterministic pattern matching over whole files, with comment, docstring and prose suppression, per-pattern case sensitivity, and a confidence score. No model.
• score computes CVSS v4.0 base scores through the cvss implementation of the FIRST specification, and evaluates the SSVC deployer decision tree. Both are reproducible; the same finding scores identically on every run.
• report renders Markdown with no model call, including a plain-language summary per finding.

The boundary between stages is a versioned JSON scan contract. Save it with --json, diff it across commits, score it offline.

What is not built yet

Stated plainly, because the gap between what a security tool claims and what it does is itself a security problem.

• Recall on unseen code is unmeasured. A clean report is not evidence of safety.
• No runtime or protocol-state analysis. Vulnerabilities defined by protocol state can be localised but not reliably classified. This is the main known ceiling, and it is why the Agentic AI layer scores lowest above.
• No taint tracking. A rule sees a construct, not whether attacker-controlled data reaches it.
• --narrative output is not reproducible. It is a language model; the deterministic report underneath it is.
• Python has the strongest context analysis. Other languages get a weaker heuristic and therefore more noise.

Full detail in the limitations table.

Links

• Source and issues: https://github.com/DINAKAR-S/Agentic-MCP-Scanner
• Changelog: https://github.com/DINAKAR-S/Agentic-MCP-Scanner/blob/main/CHANGELOG.md
• Contributing: https://github.com/DINAKAR-S/Agentic-MCP-Scanner/blob/main/CONTRIBUTING.md — a new rule needs a true-positive test, a false-positive test, and a benchmark run showing it costs nothing
• Security policy: https://github.com/DINAKAR-S/Agentic-MCP-Scanner/blob/main/SECURITY.md

License

MIT