redteam-mcp 0.4.0

It doesn't tell you where your walls are thin. It walks through them.

I build MCP connectors and AI automation for businesses. 70+ connectors deployed across client projects. Some of them started acting up — dropping connections, config conflicts, servers I forgot to remove still sitting in config eating resources.

Went looking for something to audit this. Found mcp-scan — only reads tool descriptions, doesn't touch source code. Cisco's scanner — 78% false positives. Nothing that actually reads the server code and says "line 42, you have exec() with unsanitized input."

Built my own. Ran it on 106 public MCP servers. 7 had remote code execution. One of them had 25K GitHub stars.

Open-sourced because if my connectors had these problems, so do yours.

Two modes of operation:

• Claude Code plugin — reads source code, probes tools, detects behavioral mismatches, maps cross-server attack chains. Interactive HTML report.
• Standalone CLI — deterministic scan. 25 Semgrep rules + 6 config health checks, SARIF output. Works in CI/CD without Claude.

What works today

What doesn't work yet

• Audit history (JSONL log, cross-run comparison of new/confirmed/fixed findings)
• Cross-server chain detection in CLI (exists in Claude Code plugin only)
• Auto-fix in CLI (exists in Claude Code plugin only)
• MCPTox benchmark validation
• Community rule contributions

Install

Claude Code plugin (deep AI-native audit):

# Clone to your projects directory
git clone https://github.com/m0rvayne/mcp-redteam.git
cd mcp-redteam

# The CLAUDE.md file activates as a skill automatically
# From any project with MCP servers connected:
/mcp-redteam

Standalone CLI (deterministic, CI/CD ready):

pip install redteam-mcp
mcp-redteam scan ./your-mcp-server --no-llm

Remote MCP server (via URL, OAuth or token):

pip install 'redteam-mcp[remote]'
mcp-redteam scan-remote https://your-server.com/mcp --token <bearer>

Requires Python 3.10+. Semgrep installed separately for code analysis: pip install semgrep.

More examples:

# HTML report
mcp-redteam scan ./server --format html -o report.html

# Fail CI on critical findings
mcp-redteam scan ./server --fail-on critical --format sarif -o results.sarif

# Use a different LLM model for behavioral analysis
MCP_REDTEAM_MODEL=claude-haiku-4-5 mcp-redteam scan ./server

What it checks

Config Health (deterministic)

Dead/disconnected servers, scope conflicts (same server in multiple scopes), credentials in git-tracked config files (CVE-2025-59536), unpinned npx/uvx packages (supply chain), enableAllProjectMcpServers bypass (CVE-2026-21852), orphaned MCP processes.

Code Security (Semgrep, 25 rules)

Based on 48+ CVEs, OWASP MCP Top 10, and research from Invariant Labs, Trail of Bits, Palo Alto Unit 42, OX Security, and Snyk.

LLM Behavioral Analysis (optional, requires API key)

• Behavioral mismatch: tool description claims X, code does Y
• Hidden operations: undeclared network requests, file writes, subprocess calls
• Credential mishandling: secrets logged, leaked in errors, stored insecurely

How it compares

Why not just use mcp-scan?

mcp-scan reads what a server says about itself — tool descriptions. mcp-redteam checks what a server actually does — source code analysis + behavioral analysis.

A server with clean descriptions but leaky code: mcp-scan passes it. We catch it.

Real findings mcp-scan cannot detect (they live in code, not descriptions):

• Trello API keys in .env committed to git
• Instagram session cookies stored in plaintext
• AppleScript injection via unescaped clipboard input
• Google OAuth tokens with permissions 644

Audit History (planned for v1.0)

Audit history is not yet implemented. The planned design: each audit saves a JSONL log, and subsequent runs compare results to classify findings as confirmed, new, or fixed — turning LLM non-determinism into an advantage.

Architecture

 /mcp-redteam
      |
 +-----------------+
 | Phase 0: Config |
 +-----------------+
      |
 +-----------+
 | Discovery |
 +-----------+
      |
      |   1 server = 1 agent
      |
 +----------+ +----------+ +----------+ +----------+
 | Agent-01 | | Agent-02 | | Agent-03 | | Agent-N  |
 | youtube  | | trello   | | instagram| | server-N |
 | health   | | health   | | health   | | health   |
 | arch     | | arch     | | arch     | | arch     |
 | complete | | complete | | complete | | complete |
 | security | | security | | security | | security |
 +----+-----+ +----+-----+ +----+-----+ +----+-----+
      |            |            |            |
      +------+-----+-----+------+
             |
 +-------------------------+
 | Chain analysis + report |
 +-------------------------+
             |
    +----------------+
    | HTML + Fix     |
    +----------------+

Tests

95+ tests across 9 test files:

• test_semgrep.py — each vulnerable fixture detected, each benign fixture clean
• test_self_security.py — 21 tests: our own code audited for vulnerabilities
• test_stress.py — 1000/10000 findings, concurrent scans, unicode
• test_fuzzing.py — Hypothesis property-based: any input, no crash
• test_edge_cases.py — corrupt JSON, missing files, null bytes, timeouts
• test_models.py + test_formatters.py — unit tests for core logic
• test_cli.py — 11 tests: CLI argument parsing, output formats, exit codes
• test_config_scanner.py — 13 tests: config health checks, scope conflicts, credential detection

Current Limitations

• Plugin requires Claude Code with connected MCP servers
• CLI requires semgrep for code analysis (graceful skip if not installed)
• LLM analysis requires ANTHROPIC_API_KEY
• Destructive tests intentionally skipped — read-only probing only
• Source code analysis works for local servers; pip/npm packages may have limited access
• Plugin report quality scales with model capability (Opus > Sonnet > Haiku)
• False positive rate not yet measured on production MCP servers

Known False Positive Patterns

• SSRF rule triggers on httpx.get() with URL built from config, not user input
• Path traversal rule triggers on open() where path is validated but validation isn't recognized as sanitizer
• Stdout pollution flags print() in __main__ block (safe, not in MCP handler)

Docs

The docs/ folder is useful independently:

• attack-playbook.md — 18 attack categories, 48+ CVEs, payloads and detection methods
• best-practices.md — MCP server security checklist
• reference-server.md — secure server templates (Python + Node.js)

References

• OWASP MCP Top 10
• Invariant Labs — Tool Poisoning Attacks
• Trail of Bits — MCP Security Layer
• Palo Alto Unit 42 — MCP Attack Vectors
• OX Security — STDIO Design Flaw
• NSA — MCP Security Guidance
• Vulnerable MCP Project

License

MIT