MCP-Scan: A Scanner for Model Context Protocol Configurations
MCP-Scan is a tool developed by Invariant Labs under the Snyk umbrella, designed to scan Model Context Protocol (MCP) configurations for security vulnerabilities. Released in 2025 under the Apache 2.0 license, MCP-Scan is implemented in Python and focuses on detecting threats such as tool poisoning, rug pulls, tool shadowing, and cross-server attacks. It also includes a proxy mode for runtime monitoring, making it a critical asset for securing agent and tool environments.
The tool is part of a broader suite called Agent Scan, which extends its capabilities to include the discovery and scanning of agent components, including MCP servers, skills, and harnesses. While MCP-Scan itself is distinct, it operates within the same ecosystem, sharing foundational principles for threat detection in AI-driven workflows.
Agent Scan, which includes MCP-Scan functionality, is available as a Python package or a standalone binary. It is not distributed via npm but can be installed using uvx or downloaded directly from GitHub Releases. The tool is designed to integrate with Snyk’s broader security infrastructure, requiring an API token for authentication during scans.
How It Works
MCP-Scan operates by analyzing MCP configurations to identify security risks. When scanning MCP configurations, it may execute commands or initiate outbound network requests to retrieve tool descriptions. This process involves starting stdio MCP servers or connecting to remote MCP server URLs as defined in the configuration.
- Loopback and private addresses remain permitted for local and internal MCP servers.
- HTTP redirects are not followed, and DNS validation occurs before each request, though a DNS-rebinding window remains a potential risk.
- By default, MCP-Scan requires explicit user consent before contacting each discovered MCP server during interactive scans. Background or push-key scans automatically inspect remote servers without requiring manual approval, unless the --dangerously-run-mcp-servers flag is enabled.
The tool supports two primary modes of operation: scanning via uvx or using a standalone binary. Users must first obtain an API token from Snyk and set it as an environment variable (SNYKTOKEN) before running any scan.
Use Cases
MCP-Scan is tailored for organizations and developers managing AI agents and tools that rely on MCP configurations.
- Detecting tool poisoning: Identifying malicious modifications to tools within an MCP environment, which could manipulate agent behavior or extract sensitive data.
- Mitigating tool shadowing: Detecting unauthorized or hidden tools that operate alongside legitimate ones, potentially exfiltrating data or executing unintended actions.
- Runtime monitoring via proxy mode: Enabling real-time oversight of MCP configurations during active use, ensuring continuous security even as tools and agents operate.
Beyond MCP-specific threats, Agent Scan—of which MCP-Scan is a component—extends its capabilities to agent skills, detecting risks such as prompt injections, malware payloads, untrusted content, credential handling, and hardcoded secrets.
The tool auto-discovers MCP configurations and agent tools across supported platforms, including Claude Code/Desktop, Cursor, Gemini CLI, Windsurf, GitHub Copilot, Amp, Amazon Q, and others. Its detection coverage varies by operating system (macOS, Linux, Windows) and configuration scope (system, user, project/workspace, or extension/plugin).
Key Features & Capabilities
- Auto-discovery of MCP configurations and agent tools: The tool scans for installed agents and their configurations, including those from major platforms like VS Code, GitHub Copilot, and Claude.
- Detection of 14+ distinct security risks: Depending on the version, MCP-Scan identifies threats such as prompt injection, tool poisoning, tool shadowing, toxic flows, untrusted content, private data exposure, destructive capabilities, and malicious code in skills.
- Agent Scan v0.5.x (planned for deprecation) detects 15+ risks, including MCP-specific threats like prompt injection, tool poisoning, and toxic flows, as well as skill-related risks such as malware payloads and credential handling.
- Operating system and scope support: The tool supports a wide range of agents across macOS, Linux, and Windows, with varying levels of coverage for MCP servers and skills.
- Sandboxing and consent mechanisms: To enhance security, MCP-Scan recommends running scans in sandboxed environments (e.g., Docker containers or VMs) when evaluating untrusted configurations. Interactive scans prompt users for consent before executing commands or connecting to remote servers, reducing the risk of unintended actions.
- Enterprise integration: For organizations using Snyk’s Evo platform, the underlying risk assessment and discovery mechanisms remain stable. CLI output may differ from what is displayed in Evo, but enterprise deployments are supported with guidance from Snyk’s account teams.
- Technical report on agent skill ecosystems: A companion technical report published with Agent Scan v0.4 explores emerging threats in agent skill ecosystems, providing context for the risks detected by MCP-Scan.
The tool’s output structure is experimental and subject to change between releases. Users are advised not to rely on specific CLI fields or issue codes for production workflows, as these may evolve. However, the core detection and analysis capabilities remain stable, particularly for enterprise deployments.
Supported Agents and Detection Coverage
MCP-Scan and Agent Scan support a diverse range of AI agents, each with varying levels of MCP server and skill detection across operating systems.
Agent | macOS MCP | macOS Skills | Linux MCP | Linux Skills | Windows MCP | Windows Skills
Windsurf | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
Cursor | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
GitHub Copilot | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
Claude Desktop | ✓ | ✗ | — | — | ✓ | ✗
Claude Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
Amp | ✗ | ✓ | ✗ | ✓ | ✗ | ✓
Amazon Q | ✓ | ✗ | ✓ | ✗ | ✓ (WSL) | ✗
Detection coverage also varies by configuration scope, as illustrated in the following matrix. The four scopes—system, user, project/workspace, and extension/plugin—define where and how agents and their components are scanned:
Agent | System skills | System servers | User skills | User servers | Project / WS skills | Project / WS servers | Ext / plugin skills | Ext / plugin servers
Windsurf | ✓ | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
Cursor | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
GitHub Copilot | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
Claude Desktop | N/A | N/A | ✗ | ✓ | N/A | N/A | N/A | ✗
Claude Code | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
Amp | N/A | ✗ | ✓ | ✗ | ✗ ‡ | ✗ | ✗ | ✗
Amazon Q | N/A | N/A | N/A | ✓ | N/A | ✗ | N/A | N/A
‡ Amp lacks project/workspace server support.
Users are encouraged to verify downloads using provided SBOMs, checksums, and signed checksums to ensure integrity.