广告合作
MCP.so
登录

MCP-Scan: An MCP Security Scanner

@invariantlabs-ai

代码仓库

基本信息

分类

开发工具

许可证

Apache-2.0

传输方式

stdio

作者

invariantlabs-ai

关于 MCP-Scan: An MCP Security Scanner

Security scanner for AI agents, MCP servers and agent skills.

MCP-Scan: An MCP Security Scanner 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "mcp-scan": {
      "command": "uvx",
      "args": [
        "snyk-agent-scan@latest"
      ]
    }
  }
}

MCP-Scan: An MCP Security Scanner 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

点击上方按钮,在临时沙箱中运行此服务器并实时获取工具列表。

概览

What is MCP-Scan: An MCP Security Scanner?

MCP-Scan (also known as Snyk Agent Scan) is a security scanner that discovers and scans agent components on your machine—including MCP servers, agent tools, and skills—for prompt injections, malware payloads, and other vulnerabilities. It is designed for developers and security teams who need to inspect the supply chain of AI agents.

How to use MCP-Scan: An MCP Security Scanner?

Obtain a Snyk API token and set it as the SNYK_TOKEN environment variable. Install uv on your system, then run uvx snyk-agent-scan@latest to auto-discover and scan all agents, MCP servers, and skills. You can also scan specific MCP configuration files or skill files by passing file paths as arguments.

Key features of MCP-Scan: An MCP Security Scanner

  • Auto-discovers MCP configurations, agent tools, and skills
  • Detects 15+ distinct security risks (e.g., prompt injection, tool poisoning)
  • Supports scanning of Claude, Cursor, Windsurf, Gemini CLI, and more
  • Interactive consent prompt before running any stdio MCP server
  • Background mode for enterprise-wide monitoring via Snyk Evo

Use cases of MCP-Scan: An MCP Security Scanner

  • Scan your local machine for vulnerable MCP servers and agent skills
  • Integrate security into CI/CD pipelines (non‑interactive mode)
  • Monitor the company‑wide agent supply chain from a central dashboard

常见问题

1

Do I need a Snyk account to use it?

Yes. You must sign up at Snyk, obtain an API token, and set it as the `SNYK_TOKEN` environment variable.

2

What happens when scanning MCP configuration files?

Scanning an MCP config executes the commands defined in it to retrieve tool descriptions. Agent Scan prompts for user consent before starting each stdio server; for non‑interactive environments use `--dangerously-run-mcp-servers`.

3

Is my data shared with Snyk?

Yes. Skills, agent applications, tool names, and descriptions are shared with Snyk for security analysis. Agent Scan does not store or log the contents or results of MCP tool calls.

4

Which agents are supported?

Claude Desktop/Code, Cursor, Windsurf, VS Code, Gemini CLI, Amazon Q, and several others across macOS, Linux, and Windows.

5

What are the runtime requirements?

Python (via PyPI package `snyk-agent-scan`), the `uv` tool, and network access to Snyk’s API.

评论

开发工具 分类下的更多 MCP 服务器

Moxie Docs

Jackalope-Dev

Automated codebase documentation for GitHub: searchable docs, MCP context for AI agents, doc drift detection, and Friday Cleanup PRs.

1

Perfex CRM

themesic

Turn Perfex CRM into an AI-ready workspace. This MCP server exposes your full REST API to Claude, ChatGPT and any AI agent, so leads, invoices and tasks are one prompt away.

1

Modelglass

Modelglass

Modelglass turns "which model should I use?" into a lookup instead of a guess. Seven tools give your agent live pricing across image, language, video, and audio models. Sourced and versioned, not scraped once and forgott

1

FARPY

mangomunchr

Verified distributed compute for humans, applications, and agents. Submit Blender, Octane, and video workloads, route them across qualified GPUs, track asynchronous execution, download finished artifacts, and verify FARP

1

LastPing

LastPing

Know when your AI agents, cron jobs and CI pipelines fail, stall or go quiet. Your agent sets up monitors from a plain description, tells you what is broken and why, reads run history and traces, and writes notes on inci

广告合作