npm / mcp-server-security-scanner
Give your agent an MCP configuration, tool definitions, server package names and versions, or an authentication configuration. It returns structured findings with severity and remediation guidance, and can turn supplied scan results into a Markdown report.
What it does
The package performs static, rules-based checks on the data you give it. Each tool returns either a human-readable summary with JSON serialized as text, or a Markdown report.
scan_config
Reads one JSON MCP configuration and checks its mcpServers entries for
secret patterns, risky command permissions, transport and authentication indicators,
and known-vulnerable package patterns.
scan_tool_definitionsExamines supplied descriptions and input schemas for prompt-injection and tool-poisoning patterns, broad filesystem access, unrestricted path, command, or URL fields, and possible data-exfiltration patterns.
check_cvesMatches supplied server names and optional versions against the package's bundled 18-entry MCP CVE database, returning matching records, severities, CVSS scores, and remediation text.
validate_authReviews supplied OAuth, API-key, bearer-token, or no-auth settings for PKCE, required fields, redirect URIs, token lifetime and storage, rotation, and scope configuration.
generate_reportCombines supplied findings or structured scan results into Markdown with a capped 0–100 risk score, severity counts, remediation details, and an eight-item SOC 2 criteria checklist.
Agent workflows
These calls use the shipped tool names and accepted input fields exactly as registered by the server.
Ask the agent to run scan_config against the repository's
.mcp.json, then review the returned findings before merging a server
addition.
{
"configPath": "./.mcp.json"
}
Pass a discovered tool definition to scan_tool_definitions. The agent can
triage any description, schema, broad-access, or exfiltration-pattern findings before
enabling the tool.
{
"tools": [
{
"name": "read_file",
"description": "Reads a file from the workspace",
"inputSchema": {
"type": "object",
"properties": {
"path": {
"type": "string",
"description": "Workspace-relative file path"
}
},
"required": ["path"]
}
}
]
}
Have the agent call check_cves with the package name and installed
version, then review any snapshot matches and their remediation before rollout.
{
"servers": [
{
"name": "@modelcontextprotocol/server-filesystem",
"version": "0.5.0"
}
],
"listAll": false
}Quickstart
The published npm package is mcp-server-security-scanner. Its default
transport is stdio.
~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json. In the app: Settings → Developer → Edit Config.
~/.cursor/mcp.json
Or .cursor/mcp.json inside a single project.
~/.codeium/windsurf/mcp_config.json
Cascade panel → MCP icon → edit the raw config.
All three clients accept the same object. If the file already has an mcpServers block, add just the "security-scanner" entry inside it.
{
"mcpServers": {
"security-scanner": {
"command": "npx",
"args": ["-y", "mcp-server-security-scanner"]
}
}
}No env block is needed to start: the first 3 tool calls total across this server's tools run without a license.
$ claude mcp add --transport stdio security-scanner -- npx -y mcp-server-security-scannerCheck it registered with claude mcp list. Add a key later with --env LICENSE_KEY=your-key placed before --transport.
claude mcp list and look for ✔ Connected.Running npx -y mcp-server-security-scanner in a terminal looks frozen — that is correct. It is a stdio server: it waits silently for an MCP client on stdin and never returns a prompt. Press Ctrl+C to exit. Use the config above rather than the bare command; your client starts the process for you.
A key arrives on screen right after checkout. Add it as an environment variable in the same entry:
{
"mcpServers": {
"security-scanner": {
"command": "npx",
"args": ["-y", "mcp-server-security-scanner"],
"env": {
"LICENSE_KEY": "paste-your-key-here"
}
}
}
}Keys are verified offline against a public key compiled into the package — no account, no network check, no usage reporting. Lost the key? Recover it here. More detail on the FAQ.
Scope & limitations
Treat findings as review signals, not proof that a deployment is safe or vulnerable.
It does not connect to target MCP servers, execute exploits, inspect live network traffic, or continuously monitor deployments. The checks operate on supplied files and objects.
It scans one JSON MCP configuration and supplied tool metadata. It does not traverse an application repository or analyze arbitrary implementation source code.
CVE checks use the database bundled with the package, which reports a last-updated date of 2026-03-15. Matching uses package-name normalization and simple version-range comparisons; it does not query an external advisory service.
The generated SOC 2 checklist is a mapping from detected categories, not an audit or certification. The server recommends remediation but does not edit configs, rotate secrets, patch dependencies, or enforce policy.
Start with evidence
Run the package with no license key for the one-time three-call trial, or review the current Personal, Team, and Enterprise options on the main pricing page.