MCP安全扫描工具

MCP Security Scan

Security scanner for Model Context Protocol (MCP) servers. Finds hardcoded secrets, unsafe execution patterns, data exfiltration risks, filesystem access issues, code obfuscation, and missing authentication.

Available as a GitHub Action and a CLI tool.

Why?

We statically scanned 7,029 public MCP servers (part of a 35,689-endpoint agent-ecosystem corpus):

• 9% — nearly 1 in 11 — ship at least one high or critical issue detectable by static analysis alone
• Most common: hardcoded secrets, unsafe shell/exec with user-controllable input, credential-exfiltration paths, filesystem access far broader than advertised

Full prevalence data + methodology: Agent Tool Supply-Chain Security: Prevalence from 35,689 Scans.

MCP servers run on your machine with access to your files, shell, and API keys — and increasingly get called in a loop by autonomous agents with nobody watching. Recent incidents like GitLost (GitHub's AI agent tricked into leaking private repos) and MCPoison / CVE-2025-54136 (the Cursor mcp.json rug-pull) live on this exact attack surface. Most MCP servers have no security review process.

What it detects

Twelve finding categories, all open source:

The hosted scanner at agentgraph.co/check adds what a local one-shot scan structurally can't: every verdict signed as an offline-verifiable attestation (Ed25519/JWS), tool-definition pinning with drift detection across re-scans (a tool that changes after you vetted it fails verification), and vulnerable-dependency intelligence from a 35,689-endpoint scan corpus.

Quick Start

GitHub Action (recommended)

Add this to .github/workflows/mcp-security.yml:

name: MCP Security Scan
on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: AgentAvow/mcp-security-scan@v1
        with:
          fail-on: critical

That's it. The action will:

• Scan your repository for security issues
• Post a detailed comment on pull requests
• Fail the check if critical findings are detected

CLI

pip install mcp-security-scan

# Scan any MCP server repo on GitHub
mcp-security-scan owner/repo

# Scan the current repo (auto-detects from git remote)
mcp-security-scan

# JSON output for programmatic use
mcp-security-scan owner/repo --format json

# Fail CI on critical findings
mcp-security-scan owner/repo --fail-on critical

Advanced Usage

Action Inputs

Action Outputs

Using Outputs in Your Workflow

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: AgentAvow/mcp-security-scan@v1
        id: scan
        with:
          fail-on: high

      - name: Check trust score
        if: steps.scan.outputs.trust-score < 50
        run: echo "Trust score is below 50 — review findings"

Scanning a Different Repository

- uses: AgentAvow/mcp-security-scan@v1
  with:
    repo: some-org/their-mcp-server
    token: ${{ secrets.GITHUB_TOKEN }}

CLI Flags

What It Scans

The scanner checks for 6 categories of security issues:

:key: Hardcoded Secrets (critical/high)

• AWS access keys and secret keys
• OpenAI, Anthropic, Google API keys
• GitHub tokens, Slack tokens, Stripe keys
• Private key blocks (RSA, etc.)
• Generic API key and password assignments

:warning: Unsafe Execution (critical/high)

• subprocess.run(), os.system(), os.popen() (Python)
• shell=True in subprocess calls (Python -- critical)
• eval(), exec() (Python/JS)
• child_process, execSync (Node.js)
• Command::new (Rust), exec.Command (Go)

:file_folder: Filesystem Access (medium/high)

• Unrestricted file read/write operations
• Path traversal patterns (../)
• Recursive delete (shutil.rmtree, rimraf)

:satellite: Data Exfiltration (high/critical)

• Outbound HTTP requests with sensitive data
• Encoded data transmission patterns
• Suspicious network calls in unexpected contexts

:detective: Code Obfuscation (high)

• Base64-encoded code execution
• Dynamic code generation patterns
• Obfuscated variable names and control flow

:white_check_mark: Positive Security Signals (reduce risk)

• Authentication and authorization checks
• Input validation (Zod, Pydantic, JSON Schema)
• Rate limiting
• CORS configuration
• Security headers (Helmet, CSP)

Example PR Comment

When the action runs on a pull request, it posts a comment like this:

MCP Security Scan Results

:white_check_mark: Trust Score: 85/100 (Good)

• :white_check_mark: Credential Theft -- Clear
• :white_check_mark: Data Exfiltration -- Clear
• :warning: Unsafe Execution -- 2 findings
• :white_check_mark: Filesystem Access -- Clear
• :white_check_mark: Code Obfuscation -- Clear

Metric	Value
Files scanned	45
Language	Python
Positive signals	Input validation, Rate limiting

Findings (2)

Severity	Category	Name	File	Line
high	unsafe_exec	subprocess.run	src/tools.py	42
medium	unsafe_exec	os.popen	src/utils.py	18

Trust Score

Each scanned repo receives a score from 0 to 100:

Contributing

Found a false positive? Missing a detection pattern? PRs welcome.

Good first issues:

• Add detection for more secret patterns (Twilio, SendGrid, etc.)
• Reduce false positives on path traversal in test files
• Add support for local directory scanning (not just GitHub repos)
• Add SARIF output format for GitHub Code Scanning integration

License

MIT -- see LICENSE.

Built by AgentAvow -- trust infrastructure for AI agents.