MCP Security Scanning

When the user asks to scan MCP servers or check for security issues in MCP configurations, use the uv run mcp-scanner CLI tool. This tool detects prompt injection, tool poisoning, command injection, data exfiltration, and other MCP-specific threats.

Important: Always run mcp-scanner using uv run mcp-scanner to ensure proper dependency management.

Threat Types Detected

• Prompt Injection: Malicious instructions embedded in tool descriptions or prompts
• Tool Poisoning: Tools that claim to do one thing but actually perform malicious actions
• Command Injection: Tools that execute arbitrary system commands
• Data Exfiltration: Tools that leak sensitive data to external endpoints
• Privilege Escalation: Tools that request excessive permissions
• Cross-Origin Attacks: Tools that access unauthorized resources
• Behavioral Mismatches: Discrepancies between documented and actual tool behavior

Analyzers