MCP Scan

@Chris79OG

Basic information

About MCP Scan

MCP server security scanner that detects vulnerability patterns in MCP server configurations and outputs SARIF reports. Scans for prompt injection risks, tool poisoning, excessive permissions, and other security issues in Model Context Protocol servers.

#security #scanner #vulnerability #sarif #mcp #audit

MCP Scan config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "mcp-scan": {
      "command": "npx",
      "args": [
        "@syntrophy/mcp-scan"
      ]
    }
  }
}

MCP Scan tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

Fetch the live tool list by running this server in a temporary sandbox using the button above.

Overview

What is Mcp Scan?

Mcp Scan is a security scanner for MCP servers. It detects common vulnerability patterns such as prompt injection and tool poisoning, flags excessive permissions, and outputs its findings as SARIF 2.1.0 reports.

How to use Mcp Scan?

Run it directly via npx without installation: npx @syntrophy/mcp-scan. No other configuration or invocation details are provided in the README.

Key features of Mcp Scan

Detects prompt injection risks
Identifies tool poisoning patterns
Flags excessive permissions
Outputs standard SARIF 2.1.0 reports
Runs without persistent installation via npx

Use cases of Mcp Scan

Auditing an MCP server for prompt injection vulnerabilities
Scanning for tool poisoning before deploying an MCP server
Checking an MCP server’s permission model for over‑broad access
Generating SARIF reports for integration with CI/CD pipelines

Frequently asked questions

What vulnerability types does Mcp Scan detect?

It detects prompt injection risks, tool poisoning patterns, and excessive permissions.

How do I install Mcp Scan?

Installation is not required; run it directly with `npx @syntrophy/mcp-scan`.

What output format does the scanner produce?

It outputs standard SARIF 2.1.0 reports.

Is Mcp Scan a standalone CLI tool?

Yes, it is executed as a one‑off command via npx; no explicit runtime dependencies are mentioned in the README.

Comments

More Developer Tools MCP servers

Modelglass

Modelglass turns "which model should I use?" into a lookup instead of a guess. Seven tools give your agent live pricing across image, language, video, and audio models. Sourced and versioned, not scraped once and forgott

Casefile

azimov777

One case file per task — shared by every session, agent and person that touches it. Self-hosted MCP server and live board. MIT.

FARPY

mangomunchr

Verified distributed compute for humans, applications, and agents. Submit Blender, Octane, and video workloads, route them across qualified GPUs, track asynchronous execution, download finished artifacts, and verify FARP

offprompt

MCP server that lets Claude Code, Cursor or Codex ask you for API keys on a local page and write them to .env. The agent only ever sees key names.

Nebelus

Nebelus is an enterprise agentic-AI platform for regulated industries. This MCP server exposes the Nebelus Construction API: ~48 tools that give an MCP client full agent build parity — create/update/probe agents, edit ag