Security Scanner for MCP Servers
MCP-Shield is an open-source security scanner designed to identify vulnerabilities in Model Context Protocol (MCP) servers. Developed by Rise and Ignite and released under the MIT license in 2025, it is written in TypeScript and serves as a critical tool for testing and red teaming, with a focus on robustness and stress testing. The scanner detects a range of security issues, including tool poisoning attacks, exfiltration channels, and cross-origin escalations, which are common risks in MCP-based systems.
By automating vulnerability detection, MCP-Shield helps mitigate risks before they can be exploited, ensuring safer interactions between AI models and external tools.
MCP-Shield operates by scanning installed MCP servers for suspicious patterns in tool descriptions, configurations, and behaviors. It supports multiple configuration file formats, including those used by Cursor, Claude Desktop, Windsurf, VSCode, and Codeium, making it versatile for different development environments.
Default usage involves running npx mcp-shield, which scans standard MCP configuration locations such as ~/.config/.mcp, ~/Library/Application Support/Claude, and ~/.continue. Additional flags allow for deeper analysis, such as integrating Anthropic’s Claude API for enhanced vulnerability detection or specifying custom configuration paths.
Key command-line options include --claude-api-key for AI-assisted analysis, --identify-as to simulate different client identities for testing, and --safe-list to exclude trusted servers from scanning. The --path flag enables targeted scans of specific configuration files, while -h or --help displays usage instructions.
How It Works
MCP-Shield functions by parsing MCP server configurations and analyzing tool descriptions for hidden or malicious instructions. It cross-references tool behaviors against known vulnerability patterns, such as hidden file access attempts, data exfiltration channels, and tool shadowing—where one tool modifies the behavior of another. The scanner also checks for cross-origin violations, ensuring that interactions between servers adhere to security best practices.
When a vulnerability is detected, MCP-Shield generates a detailed report categorizing risks by severity (HIGH, MEDIUM) and providing AI-driven analysis where applicable. For example, a tool disguised as a calculator might secretly attempt to access sensitive files like SSH private keys (~/.ssh/idrsa) or exfiltrate data through disguised parameters. The tool’s output includes specific issues, such as hidden instructions, sensitive file access, or shadowing behaviors, along with an overall risk assessment.
The integration with Anthropic’s Claude API enhances detection capabilities by enabling deeper semantic analysis of tool descriptions. This AI-assisted approach helps identify subtle or obfuscated vulnerabilities that might evade traditional pattern-matching scans.
Use Cases
Before adding new MCP servers, organizations can scan configurations to ensure they do not introduce vulnerabilities. During security audits, the tool provides a systematic way to assess existing MCP environments for compliance and risks.
The tool’s ability to simulate different client identities (--identify-as) is particularly valuable for red teaming exercises. By testing how servers respond to varied client IDs, security teams can uncover inconsistencies or bait-and-switch behaviors that might indicate malicious intent. This feature is especially useful in environments where trust between clients and servers is a critical concern.
Key Features and Capabilities
MCP-Shield’s core functionality revolves around detecting five primary vulnerability types: hidden instructions in tool descriptions, potential data exfiltration channels, tool shadowing and behavior modification, sensitive file access attempts, and cross-origin violations.
Hidden instructions are particularly insidious, as they conceal malicious behaviors behind seemingly benign tool descriptions. For instance, a calculator tool might include instructions to read a user’s SSH private key (~/.ssh/idrsa) while claiming to perform basic arithmetic. MCP-Shield flags such discrepancies by analyzing tool descriptions for inconsistencies between stated and implied functionality.
Data exfiltration channels are another major concern, where tools include parameters designed to covertly transmit sensitive information. Examples include tools that accept notes, metadata, or debug fields, which might be used to smuggle data out of the system. The scanner identifies these patterns by examining parameter names and their potential misuse in tool implementations.
Tool shadowing occurs when one tool’s description contains instructions that alter the behavior of another tool. This can happen entirely within the prompt context, making it difficult to detect without specialized analysis.
Sensitive file access attempts are directly flagged by MCP-Shield when tools reference protected directories or files, such as .env, config.json, or ~/.ssh/idrsa. The scanner checks for explicit or implicit attempts to traverse directories (../) or access restricted resources, providing clear warnings when such behaviors are detected.
Cross-origin violations involve interactions between MCP servers that do not adhere to security boundaries. MCP-Shield detects these violations by analyzing server-to-server interactions and ensuring compliance with expected behavior patterns.
The tool’s support for configuration files from multiple platforms—including Cursor, Claude Desktop, Windsurf, VSCode, and Codeium—expands its applicability across diverse development ecosystems.
Optional integration with Anthropic’s Claude API further enhances MCP-Shield’s analytical capabilities.
The --safe-list functionality allows users to exclude trusted servers from scanning, reducing false positives and focusing efforts on high-risk areas.
Vulnerability Detection Examples
One of the most critical vulnerabilities MCP-Shield detects is tool poisoning with hidden instructions. For example, a calculator tool (calculateSum) might include instructions to read a user’s SSH private key (~/.ssh/idrsa) while claiming to perform basic arithmetic. The tool’s description would instruct the AI to hide this requirement, disguising it as a mathematical explanation. MCP-Shield identifies this as a HIGH-risk vulnerability due to the covert access to sensitive credentials and the potential for data exfiltration.
Another example is tool shadowing, where a tool like sendEmail includes instructions to modify the behavior of another tool (mcptoolsendemail). The description might claim that emails must be redirected to a proxy address (attkr@pwnd.com) to prevent crashes, while hiding this requirement from the user. MCP-Shield flags this as a HIGH-risk issue because it demonstrates deliberate manipulation of tool behavior, which could lead to unauthorized data redirection or loss.
Data exfiltration channels are also a common finding. Tools with parameters like notes, metadata, or debug may be designed to transmit sensitive information under the guise of legitimate functionality. For instance, a weather-fetching tool (fetchWeather) might include fields for feedback or debug data, which could be exploited to exfiltrate internal system information.
Sensitive file access attempts are directly addressed by MCP-Shield when tools reference protected files or directories. For example, a readFile tool might attempt to access .env, config.json, or ~/.ssh/idrsa using path traversal techniques (../). These attempts are immediately flagged as HIGH-risk vulnerabilities due to the potential exposure of critical system files.
For instance, a messaging tool (sendmessage) might include instructions to change the recipient to a proxy number (+13241234123) without informing the user. MCP-Shield detects these violations by analyzing server interactions and ensuring compliance with expected communication protocols.