How MCP Scanner Works
MCP Scanner is a Python-based tool designed to analyze Model Context Protocol (MCP) servers and tools for security vulnerabilities. It integrates three distinct scanning engines: YARA rules for signature-based detection, an LLM-based analyzer for contextual and semantic threat assessment, and Cisco’s AI Defense API for comprehensive security evaluation. These engines can be used independently or in combination, depending on specific security requirements.
The tool operates by examining MCP servers, tool descriptions, configurations, prompts, resources, and server instructions for threats such as prompt injection, tool poisoning, and over-privileged permissions. It also performs behavioral code scanning of source code, static analysis for production readiness, and vulnerability scanning of Python dependencies using pip-audit integration.
MCP Scanner supports both standalone CLI usage and REST API deployment, offering flexibility in integration. It connects directly to MCP servers, scans pre-generated JSON files for offline or CI/CD environments, and provides detailed reporting on detected security findings.
The tool leverages VirusTotal for binary file malware scanning, PyPI package scanning in Docker sandboxes, and supports local LLM endpoints for environments without API access. Configuration is managed via environment variables for API keys, LLM providers, and VirusTotal settings, ensuring modular and adaptable deployment.
Key Use Cases
MCP Scanner addresses critical security gaps in the AI agent supply chain by identifying risks associated with MCP servers and tools.
- Detecting tool poisoning attacks, where malicious instructions are embedded in tool descriptions or metadata to exfiltrate data or alter workflows.
- Preventing rug pull attacks, where initially legitimate tools are later updated with malicious intent, exploiting an agent’s reliance on external tools.
- Identifying over-privileged tool permissions, where tools perform unauthorized actions due to broad capabilities (e.g., filesystem, network, or system calls).
- Scanning for prompt injection vulnerabilities, where malicious prompts manipulate AI agent behavior or extract sensitive information.
- Assessing MCP tool registries and public repositories for untrusted or compromised tools before integration into AI systems.
The tool is particularly valuable for security teams in enterprises deploying AI agents, as it provides proactive scanning and vulnerability assessment before deployment. It complements Cisco AI Defense by offering an open-source solution for supply chain security, ensuring AI applications are validated for integrity and safety.
Key Features & Capabilities
MCP Scanner combines multiple security analysis methods to deliver a comprehensive threat detection framework.
- Multi-Engine Security Analysis: Uses YARA rules, LLM-based analysis, and Cisco AI Defense API independently or in tandem for layered threat detection.
- Vulnerable Package Scanning: Integrates with pip-audit to scan Python dependencies for known vulnerabilities (CVE, PYSEC, GHSA).
- Behavioral Code Scanning: Analyzes source code of MCP servers for threats, including malicious logic or anomalous behavior.
- VirusTotal Binary Scanning: Detects malware in binary files (images, PDFs, executables, archives) using SHA256 hash lookups against VirusTotal’s database.
- Comprehensive Reporting: Generates detailed reports on security findings, including severity levels and remediation recommendations.
The tool supports flexible deployment modes, including CLI for ad-hoc scanning and REST API for automated integration into security workflows. Configuration is streamlined via environment variables for API keys, LLM providers (e.g., OpenAI GPT-4, AWS Bedrock Claude), and VirusTotal settings, with optional local LLM endpoint support for privacy-sensitive deployments.
The tool’s modular design ensures adaptability to evolving security challenges in AI agent ecosystems.