MCP-Scan
MCP-Scan is a security scanning tool designed to analyze MCP servers for common vulnerabilities, including prompt injections, tool poisoning, and cross-origin escalations. It connects to configured MCP servers, retrieves tool descriptions, and scans them for security risks using local checks and remote verification via Invariant Guardrails. It helps ensure the security and integrity of MCP-based systems by detecting potential attack vectors and malicious configurations.
Added on:
Created by:
Apr 28 2025
Featured
What is MCP-Scan?
MCP-Scan is a comprehensive security scanner focused on Model Context Protocol (MCP) servers. It inspects your installed MCP server configurations, connects to these servers, and retrieves detailed descriptions of their tools. The scanner then analyzes these descriptions for common security issues such as prompt injections, tool poisoning, cross-origin escalations, and MCP rug pull attacks. It utilizes both local checks and remote verification with Invariant Guardrails, sharing minimal data about tools for security analysis. MCP-Scan helps developers and security teams monitor and secure their MCP ecosystems by offering in-depth scans, vulnerability detection, and tool inspection capabilities, ensuring safer and more reliable MCP deployments.
Who will use MCP-Scan?
- Security researchers
- DevOps teams managing MCP server environments
- Developers deploying MCP applications
- Security auditors
How to use the MCP-Scan?
- Step1: Install MCP-Scan via the provided command or package manager.
- Step2: Configure MCP server addresses in the configuration file if necessary.
- Step3: Run a default scan using `mcp-scan` to analyze MCP servers for vulnerabilities.
- Step4: Review the scan reports for detected issues and possible vulnerabilities.
- Step5: Use the inspect command to analyze specific tools or prompts.
- Step6: Manage the whitelist to approve or exclude trusted tools or entities.
MCP-Scan's Core Features & Benefits
The Core Features
- Scan MCP configurations for security vulnerabilities
- Inspect tool descriptions
- Manage whitelist of trusted entities
- Detect prompt injection and tool poisoning
- Identify cross-origin escalation attacks
- Tool pinning for detecting MCP rug pulls
The Benefits
- Enhances MCP ecosystem security
- Automates vulnerability detection
- Provides detailed insights into MCP tool configurations
- Reduces risk of security breaches
- Supports compliance and security audits
MCP-Scan's Main Use Cases & Applications
- Security auditing of MCP-based AI environments
- Monitoring MCP server integrity over time
- Pre-deployment security assessments of MCP configurations
- Incident response by identifying malicious or compromised tools
- Automated security verification in CI/CD pipelines
FAQs of MCP-Scan
Developer
- invariantlabs-ai