MCP安全扫描工具

# Using pip
pip install mcpscan

# Using poetry
poetry add mcpscan

# From source
git clone https://github.com/IParikh1/mcpscan.git
cd mcpscan
poetry install

# Scan current directory
mcpscan scan .

# Scan specific config file
mcpscan scan ./mcp.json

# Scan with ML-based risk scoring
mcpscan scan ./mcp.json --risk-score

# Scan with capability graph analysis
mcpscan scan ./mcp.json --graph

# Generate remediation for issues
mcpscan scan ./mcp.json --fix

# Output as JSON
mcpscan scan . --format json -o results.json

# Output as SARIF (for GitHub Code Scanning)
mcpscan scan . --format sarif -o results.sarif

# CI mode - exit with code 1 if findings found
mcpscan scan . --ci --fail-on high

╭───────────────────────────────────────╮
│ mcpscan v0.1.0 - MCP Security Scanner │
╰───────────────────────────────────────╯

Scanning: ./mcp.json

    Scan Summary
┏━━━━━━━━━━┳━━━━━━━┓
┃ Severity ┃ Count ┃
┡━━━━━━━━━━╇━━━━━━━┩
│ CRITICAL │     2 │
│ HIGH     │     3 │
│ MEDIUM   │     2 │
│ TOTAL    │     7 │
└──────────┴───────┘

⚠️  CRITICAL (2)

  MCP-002: Hardcoded Credentials Detected
  File: mcp.json:15
  → Detected: sk-proj-abc...xyz
  Found OpenAI API key in configuration file.
  Fix: Use environment variables instead of hardcoding credentials.

  MCP-001: No Authentication Configured
  File: mcp.json:25
  → url: http://localhost:3000/mcp
  Remote MCP server has no authentication configured.
  Fix: Configure OAuth 2.0, API keys, or other authentication.

╭───────────────────── Risk Analysis: mcp.json ─────────────────────╮
│ Overall Risk: HIGH (Score: 75.2%)                                 │
│ Confidence: 95.0%                                                 │
│                                                                   │
│ Category Breakdown:                                               │
│   MCP02_Privilege_Escalation: [███████████████░░░░░] 78.3%       │
│   MCP05_Command_Injection: [███████░░░░░░░░░░░░░] 36.5%          │
│   MCP01_Token_Exposure: [████░░░░░░░░░░░░░░░░] 23.3%             │
│                                                                   │
│ Top Risk Factors:                                                 │
│   • Cloud metadata endpoints accessible (+10.0%)                  │
│   • Privileged/admin tools configured (+10.0%)                    │
│   • Dangerous tool capabilities (+8.0%)                           │
╰───────────────────────────────────────────────────────────────────╯

# Scan with ML risk scoring
mcpscan scan ./mcp.json --risk-score

# View standalone risk analysis
mcpscan risk ./mcp.json

# Show model information
mcpscan model-info

# Run graph analysis
mcpscan graph ./mcp.json

# Include in scan output
mcpscan scan ./mcp.json --graph

# Preview fixes
mcpscan fix ./mcp.json

# Save fixed config to new file
mcpscan fix ./mcp.json -o fixed.json

# Apply fixes directly (creates backup)
mcpscan fix ./mcp.json --apply

# Collect configs from your system (anonymized)
mcpscan collect --scan-system

# Collect from specific directory
mcpscan collect --dir ./my-configs

# View collection statistics
mcpscan collect --stats

# Manually label configs for training
mcpscan label ./mcp.json critical

# Validate model on collected configs
mcpscan validate-model --collection

# Retrain model with more data
mcpscan train --samples 5000

name: MCP Security Scan

on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install mcpscan
        run: pip install mcpscan

      - name: Run security scan
        run: mcpscan scan . --format sarif -o results.sarif --ci --fail-on high

      - name: Upload SARIF results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

mcp-security:
  image: python:3.11
  script:
    - pip install mcpscan
    - mcpscan scan . --format json -o gl-sast-report.json --ci
  artifacts:
    reports:
      sast: gl-sast-report.json

# .pre-commit-config.yaml
repos:
  - repo: local
    hooks:
      - id: mcpscan
        name: MCP Security Scan
        entry: mcpscan scan . --ci --fail-on high
        language: system
        pass_filenames: false

# Clone the repository
git clone https://github.com/IParikh1/mcpscan.git
cd mcpscan

# Install dependencies
poetry install

# Run tests
poetry run pytest

# Run linting
poetry run ruff check .
poetry run black --check .
poetry run mypy mcpscan