Open-source MCP security scanner

Is your MCP setup safe?

1 in 4 MCP servers has security issues. Find out in seconds.

Scan Now
3,093
servers scanned
28%
had findings
176
scored 0/100

Scan a server

Paste an npm package name or GitHub URL. We'll download it, scan it, and show you the results.

What we detect

32 rules across 8 categories, tuned for the MCP ecosystem.

Code Execution

eval(), new Function(), and dynamic code execution that can run arbitrary payloads.

Env Harvesting

Bulk reads of process.env and transmission of environment variables over the network.

Sensitive File Access

Reads of SSH keys, cloud credentials, browser profiles, crypto wallets, and .env files.

Network Exfiltration

Connections to Telegram bots, Discord webhooks, paste sites, and hardcoded IPs.

Shell Injection

Shell commands built with string interpolation — classic command injection.

Prompt Injection

Hidden instructions in descriptions that override your AI agent's behavior.

Code Obfuscation

Base64/hex decoding at runtime, hidden Unicode, and obfuscated JavaScript.

Hardcoded Secrets

API keys, private keys, tokens, and crypto wallet addresses embedded in code.

Read the research

We scanned 3,093 MCP servers from npm and the official registry. 28% had security findings. 176 scored zero. Read the full analysis.

I Scanned 3,093 MCP Servers. Here's What I Found.