MCP-Scanner v0.1.0

CRITICAL (3)
  [MCP-001] examples/vulnerable_server.py:20
  Shell execution exposed
  Evidence: subprocess.run(command, shell=True, capture_output=True, text=True)
  Why it matters: A tool that runs shell commands gives anyone who can steer the agent, including
  content injected into its context, arbitrary code execution on the host machine.
  Fix: Remove shell execution from the tool surface. Replace it with a fixed allowlist of specific
  operations that take validated, typed arguments.

  [MCP-002] examples/vulnerable_server.py:26
  Exfiltration path (network fetch plus file write)
  Evidence: server combines network fetch with local file writes
  Why it matters: One server that can both read local files or fetch network resources and write or
  send data out is a complete exfiltration channel. Prompt injection only has to convince the agent
  to use tools that already exist.
  Fix: Split network access and file writes into separate servers with least privilege, and put an
  egress allowlist in front of any fetch tool.

  [MCP-001] examples/vulnerable_server.py:63
  Shell execution exposed
  Evidence: subprocess.run(f"pip install {package}", shell=True, capture_output=True)
  Why it matters: A tool that runs shell commands gives anyone who can steer the agent, including
  content injected into its context, arbitrary code execution on the host machine.
  Fix: Remove shell execution from the tool surface. Replace it with a fixed allowlist of specific
  operations that take validated, typed arguments.

HIGH (7)
  [MCP-003] examples/vulnerable_server.py:27
  Unscoped filesystem access
  Evidence: open(dest, "w")
  Why it matters: A file tool that takes a raw path from tool input can read or overwrite anything
  the server process can reach: home directories, SSH keys, cloud credentials, other projects.
  Fix: Pin file tools to an explicit root directory and reject any resolved path that escapes it
  (resolve the path, then check the prefix).

  [MCP-003] examples/vulnerable_server.py:34
  Unscoped filesystem access
  Evidence: open(file_path)
  Why it matters: A file tool that takes a raw path from tool input can read or overwrite anything
  the server process can reach: home directories, SSH keys, cloud credentials, other projects.
  Fix: Pin file tools to an explicit root directory and reject any resolved path that escapes it
  (resolve the path, then check the prefix).

  [MCP-004] examples/vulnerable_server.py:40
  Secret access
  Evidence: os.environ[var_name]
  Why it matters: Tools or configs that expose environment variables, credential files, or the cloud
  metadata endpoint hand live secrets to the model context, where they can be logged, leaked, or
  exfiltrated.
  Fix: Never expose raw environment or credential stores as tool output. Scope credentials per
  server, inject only what that server needs, and block the link-local metadata address at the
  network layer.

  [MCP-004] examples/vulnerable_server.py:45
  Secret access
  Evidence: ~/.ssh/id_rsa
  Why it matters: Tools or configs that expose environment variables, credential files, or the cloud
  metadata endpoint hand live secrets to the model context, where they can be logged, leaked, or
  exfiltrated.
  Fix: Never expose raw environment or credential stores as tool output. Scope credentials per
  server, inject only what that server needs, and block the link-local metadata address at the
  network layer.

  [MCP-010] examples/vulnerable_server.py:58
  Dynamic code execution
  Evidence: eval(code)
  Why it matters: eval, exec, and dynamic imports inside a tool handler turn any string the model
  produces into running code, bypassing every other control in the server.
  Fix: Remove dynamic evaluation from tool handlers. Replace it with a dispatch table of named,
  audited operations.

  [MCP-003] examples/vulnerable_server.py:70
  Unscoped filesystem access
  Evidence: open(config_path)
  Why it matters: A file tool that takes a raw path from tool input can read or overwrite anything
  the server process can reach: home directories, SSH keys, cloud credentials, other projects.
  Fix: Pin file tools to an explicit root directory and reject any resolved path that escapes it
  (resolve the path, then check the prefix).

  [MCP-005] examples/vulnerable_server.py:75
  Network transport without authentication
  Evidence: network transport started with no authentication check in file
  Why it matters: An MCP server listening on HTTP or SSE with no authentication lets anyone who can
  reach the port call its tools directly, no agent required.
  Fix: Require an Authorization header or token check on every request, bind to localhost when
  remote access is not needed, and put the server behind a gateway that authenticates callers.

MEDIUM (5)
  [MCP-007] examples/vulnerable_server.py:18
  Overbroad tool description
  Evidence: description of exec_shell: "anything"
  Why it matters: Tool descriptions are instructions to the model. Descriptions that advertise
  unrestricted capability ("run any command", "access all files") teach the agent to use the tool as
  a general escape hatch and are a hallmark of malicious MCP packages.
  Fix: Describe exactly what the tool does, what it may touch, and what it must never do. Treat
  description text as part of your attack surface.

  [MCP-007] examples/vulnerable_server.py:33
  Overbroad tool description
  Evidence: description of read_file: "any file"
  Why it matters: Tool descriptions are instructions to the model. Descriptions that advertise
  unrestricted capability ("run any command", "access all files") teach the agent to use the tool as
  a general escape hatch and are a hallmark of malicious MCP packages.
  Fix: Describe exactly what the tool does, what it may touch, and what it must never do. Treat
  description text as part of your attack surface.

  [MCP-006] examples/vulnerable_server.py:50
  Mutating tool with no input schema
  Evidence: tool delete_data mutates state but its parameters have no type/schema annotations
  Why it matters: A write, delete, or execute tool with an empty input schema accepts arbitrary
  arguments with no validation layer between the model and the action.
  Fix: Give every mutating tool a strict input schema with typed, bounded fields, and validate
  arguments server-side before acting on them.

  [MCP-008] examples/vulnerable_server.py:63
  Self-modifying server
  Evidence: pip install
  Why it matters: A tool that can rewrite MCP client configs or install new packages can persist
  itself, add new malicious servers, and survive removal of the original package.
  Fix: MCP servers must never write to client configuration files or invoke package managers. Keep
  config changes manual and reviewable.

  [MCP-008] examples/vulnerable_server.py:69
  Self-modifying server
  Evidence: /home/user/.config/claude/claude_desktop_config.json
  Why it matters: A tool that can rewrite MCP client configs or install new packages can persist
  itself, add new malicious servers, and survive removal of the original package.
  Fix: MCP servers must never write to client configuration files or invoke package managers. Keep
  config changes manual and reviewable.

Summary: 1 file(s) scanned, 1 server(s) found. Findings: 3 critical, 7 high, 5 medium, 0 low, 0 info.