MCPSafe

MCP supply chain security scanner. Detect tool poisoning, prompt injection, data exfiltration, and other attacks in MCP server definitions.

Installation

pip install mcpsafe

Usage

Basic scan

mcpsafe ./my-mcp-server

JSON output

mcpsafe ./my-mcp-server --format json

SARIF for CI/CD

mcpsafe ./my-mcp-server --format sarif > results.sarif

Severity filter

mcpsafe ./my-mcp-server --min-severity HIGH

Exclude patterns

mcpsafe ./my-mcp-server --exclude "vendor/*" --exclude "node_modules/*"

Detected Vulnerabilities

Exit Codes

CI/CD Integration

MCPSafe includes a GitHub Action (action.yml) for seamless CI/CD integration. It runs a scan, uploads results as a SARIF artifact, and integrates with GitHub Code Scanning.

name: MCPSafe Scan
on:
  push:
    branches: [main]
  pull_request:

jobs:
  mcpsafe:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run MCPSafe
        uses: onicarps/MCPSafe@main
        with:
          path: "."
          severity: "LOW"
          version: "0.1.0"

      # The action automatically uploads SARIF results to GitHub Code Scanning.
      # Findings will appear under the "Security" tab in your repository.

You can also invoke MCPSafe directly in any CI pipeline:

pip install mcpsafe
mcpsafe ./my-mcp-server --format sarif > results.sarif

License

MIT