invariantlabs-ai/mcp-scan: Security scanner for AI agents, MCP servers and agent skills.

Discover and scan agent components on your machine for prompt injections
and vulnerabilities (including agents, MCP servers, skills).

NEW Read our technical report on the emerging threats of the agent skill eco-system published together with mcp-scan 0.4, which adds support for scanning agent skills.

MCP-scan helps you keep an inventory of all your installed agent components (harnesses, MCP servers, skills) and scans them for common threats like prompt injections, sensitive data handling or malware payloads hidden natural language.

• Auto-discover MCP configurations, agent tools, skills
• Detects MCP Security Vulnerabilities:
  • Prompt Injection Attacks
  • Tool Poisoning Attacks
  • Toxic Flows
• Scan local STDIO MCP servers and remote HTTP/SSE MCP servers
• Detects Agent Skill Vulnerabilities:
  • Prompt Injection Attacks, Malware Payloads
  • Exposure to untrusted third parties (e.g. moltbook)
  • Sensitive Data Handling
  • Hard-coded secrets

To get started, make sure you have uv installed on your system.

To run a full scan of your machine (auto-discovers agents, MCP servers, skills), run:

uvx mcp-scan@latest --skills

This will scan for security vulnerabilities in servers, skills, tools, prompts, and resources. It will automatically discover a variety of agent configurations, including Claude Code/Desktop, Cursor, Gemini CLI and Windsurf. Omit --skills to skip skill analysis.

You can also scan particular configuration files:

 # scan mcp configurations
uvx mcp-scan@latest ~/.vscode/mcp.json
 # scan a single agent skill
uvx mcp-scan@latest --skills ~/path/to/my/SKILL.md
# scan all claude skills
uvx mcp-scan@latest --skills ~/.claude/skills

MCP-Scan is a security scanning tool to both statically and dynamically scan and monitor your MCP connections. It checks them for common security vulnerabilities like prompt injections, tool poisoning and toxic flows. Consult our detailed Documentation for more information.

MCp-Scan operates in two main modes which can be used jointly or separately:

1. mcp-scan scan statically scans all your installed servers for malicious tool descriptions and tools (e.g. tool poisoning attacks, cross-origin escalation, rug pull attacks, toxic flows).

   Quickstart →.

2. mcp-scan proxy continuously monitors your MCP connections in real-time, and can restrict what agent systems can do over MCP (tool call checking, data flow constraints, PII detection, indirect prompt injection etc.).

   Quickstart →.

mcp-scan in proxy mode.

• Scanning of Claude, Cursor, Windsurf, and other file-based MCP client configurations
• Scanning for prompt injection attacks in tools and tool poisoning attacks using Guardrails
• Enforce guardrailing policies on MCP tool calls and responses, including PII detection, secrets detection, tool restrictions and entirely custom guardrailing policies.
• Audit and log MCP traffic in real-time via mcp-scan proxy
• Detect cross-origin escalation attacks (e.g. tool shadowing), and detect and prevent MCP rug pull attacks, i.e. mcp-scan detects changes to MCP tools via hashing

Using mcp-scan proxy, you can monitor, log, and safeguard all MCP traffic on your machine. This allows you to inspect the runtime behavior of agents and tools, and prevent attacks from e.g., untrusted sources (like websites or emails) that may try to exploit your agents. mcp-scan proxy is a dynamic security layer that runs in the background, and continuously monitors your MCP traffic.

You can also add guardrailing rules, to restrict and validate the sequence of tool uses passing through proxy.

For this, create a ~/.mcp-scan/guardrails_config.yml with the following contents:

: # your client's shorthand (e.g., cursor, claude, windsurf)
  : # your server's name according to the mcp config (e.g., whatsapp-mcp)
    guardrails:
      secrets: block # block calls/results with secrets

      custom_guardrails:
        - name: "Filter tool results with 'error'"
          id: "error_filter_guardrail"
          action: block # or just 'log'
          content: |
            raise "An error was found." if:
              (msg: ToolOutput)
              "error" in msg.content

From then on, all calls proxied via mcp-scan proxy will be checked against your configured guardrailing rules for the current client/server.

Custom guardrails are implemented using Invariant Guardrails. To learn more about these rules, see the official documentation.

MCP-Scan scan searches through your configuration files to find MCP server configurations. It connects to these servers and retrieves tool descriptions.

It then scans tool descriptions, both with local checks and by invoking Invariant Guardrailing via an API. For this, tool names and descriptions are shared with invariantlabs.ai. By using MCP-Scan, you agree to the invariantlabs.ai terms of use and privacy policy.

Invariant Labs is collecting data for security research purposes (only about tool descriptions and how they change over time, not your user data). Don’t use MCP-scan if you don’t want to share your tools. Additionally, a unique, persistent, and anonymous ID is assigned to your scans for analysis. You can opt out of sending this information using the --opt-out flag.

MCP-scan does not store or log any usage data, i.e. the contents and results of your MCP tool calls.

For runtime monitoring using mcp-scan proxy, MCP-Scan can be used as a proxy server. This allows you to monitor and guardrail system-wide MCP traffic in real-time. To do this, mcp-scan temporarily injects a local Invariant Gateway into MCP server configurations, which intercepts and analyzes traffic. After the proxy command exits, Gateway is removed from the configurations.

You can also configure guardrailing rules for the proxy to enforce security policies on the fly. This includes PII detection, secrets detection, tool restrictions, and custom guardrailing policies. Guardrails and proxying operate entirely locally using Guardrails and do not require any external API calls.

MCP-scan provides the following commands:

mcp-scan - Security scanner for Model Context Protocol servers and tools

These options are available for all commands:

--storage-file FILE    Path to store scan results and whitelist information (default: ~/.mcp-scan)
--base-url URL         Base URL for the verification server
--verbose              Enable detailed logging output
--print-errors         Show error details and tracebacks
--full-toxic-flows     Show all tools that could take part in toxic flow. By default only the top 3 are shown.
--json                 Output results in JSON format instead of rich text

Scan MCP configurations for security vulnerabilities in tools, prompts, and resources.

mcp-scan [CONFIG_FILE...]

Options:

--checks-per-server NUM           Number of checks to perform on each server (default: 1)
--server-timeout SECONDS          Seconds to wait before timing out server connections (default: 10)
--suppress-mcpserver-io BOOL      Suppress stdout/stderr from MCP servers (default: True)
--skills                          Autodetects and analyzes skills
--skills PATH_TO_SKILL_MD_FILE    Analyzes the specific skill
--skills PATHS_TO_DIRECTORY       Recursively detects and analyzes all skills in the directory

Run a proxy server to monitor and guardrail system-wide MCP traffic in real-time. Temporarily injects Gateway into MCP server configurations, to intercept and analyze traffic. Removes Gateway again after the proxy command exits.

This command requires the proxy optional dependency (extra).

• Run via uvx:

  uvx --with "mcp-scan[proxy]" mcp-scan@latest proxy

  This installs the proxy extra into an uvx-managed virtual environment, not your current shell venv.

Options:

CONFIG_FILE...                  Path to MCP configuration files to setup for proxying.
--pretty oneline|compact|full   Pretty print the output in different formats (default: compact)

Print descriptions of tools, prompts, and resources without verification.

mcp-scan inspect [CONFIG_FILE...]

Options:

--server-timeout SECONDS      Seconds to wait before timing out server connections (default: 10)
--suppress-mcpserver-io BOOL  Suppress stdout/stderr from MCP servers (default: True)

Manage the whitelist of approved entities. When no arguments are provided, this command displays the current whitelist.

# View the whitelist
mcp-scan whitelist

# Add to whitelist
mcp-scan whitelist TYPE NAME HASH

# Reset the whitelist
mcp-scan whitelist --reset

Options:

--reset                       Reset the entire whitelist
--local-only                  Only update local whitelist, don't contribute to global whitelist

Arguments:

TYPE                          Type of entity to whitelist: "tool", "prompt", or "resource"
NAME                          Name of the entity to whitelist
HASH                          Hash of the entity to whitelist

Display detailed help information and examples.

# Scan all known MCP configs
mcp-scan

# Scan a specific config file
mcp-scan ~/custom/config.json

# Just inspect tools without verification
mcp-scan inspect

# View whitelisted tools
mcp-scan whitelist

# Whitelist a tool
mcp-scan whitelist tool "add" "a1b2c3..."

This repository includes a vulnerable MCP server that can demonstrate Model Context Protocol security issues that MCP-Scan finds.

How to demo MCP security issues?

1. Clone this repository
2. Create an mcp.json config file in the cloned git repository root directory with the following contents:

3. Run MCP-Scan: uvx --python 3.13 mcp-scan@latest scan --full-toxic-flows mcp.json

Note: if you place the mcp.json configuration filepath elsewhere then adjust the args path inside the MCP server configuration to reflect the path to the MCP Server (demoserver/server.py) as well as the uvx command that runs MCP-Scan CLI with the correct filepath to mcp.json.

MCP-Scan can currently no longer accept external contributions. We are focused on stabilizing releases.
We welcome suggestions, bug reports, or feature requests as GitHub issues.

To run this package from source, follow these steps:

uv run pip install -e .
uv run -m src.mcp_scan.cli

For proxy functionality (e.g., mcp-scan proxy, mcp-scan server), install with the proxy extra:

uv run pip install -e .[proxy]

If you want to include MCP-scan results in your own project or registry, please reach out to the team via mcpscan@invariantlabs.ai, and we can help you with that.
For automated scanning we recommend using the --json flag and parsing the output.

See CHANGELOG.md.