MCPScan

The first dedicated offensive security auditor for MCP servers

Threat Landscape · Checks · Install · Usage · CVEs · Output

  MCPScan — Offensive MCP Server Auditor
  ──────────────────────────────────────────────────────────

  Server: filesystem-server  (stdio: npx @modelcontextprotocol/server-filesystem /home)
  Enumerated: 12 tools · 0 resources · 0 prompts

   CRITICAL   MCP-701  RCE Vector: Shell/Execution Parameter Name
              Location:  tool: bash_exec > inputSchema
              Evidence:  Dangerous params: command, args
              CVE:       CVE-2025-6514 (CVSS 9.6)
              Fix:       Use allowlists; never pass raw input to shell functions

   HIGH       MCP-304  Overprivileged: Unrestricted Filesystem Path Parameter
              Location:  tool: write_file > inputSchema
              Evidence:  Tool: write_file, capabilities: fs-write
              Fix:       Add a path allow-list restricting access to approved directories

   HIGH       MCP-202  Credential Leak: Anthropic API Key
              Location:  tool: call_llm > description
              Evidence:  sk-ant-api03-••••••••••••••••
              Fix:       Rotate immediately. Never embed secrets in tool metadata.

  ╭──────────────── MCPScan Results ─────────────────╮
  │                                                   │
  │   Scanned 3 servers  ·  Enumerated in 4.2s        │
  │   2 critical  ·  5 high  ·  1 medium  ·  1 low    │
  │                                                   │
  ╰───────────────────────────────────────────────────╯

🔥 Threat Landscape

MCP has become the standard for connecting AI agents to the real world — and attackers got there first. Researchers have already documented:

No dedicated offensive scanner existed. MCPScan fills that gap.

🔍 Checks

MCPScan runs 8 check categories covering the full MCP attack surface:

📋 CVE References

⚡ Install

Requires Node.js ≥ 18

git clone https://github.com/sahiloj/MCPScan.git
cd MCPScan
npm install
npm run build

Link globally and run from anywhere:

npm link
mcpscan --help

🚀 Usage

Scan a stdio server

mcpscan scan --command "npx" --args "-y @modelcontextprotocol/server-filesystem /home/user"

Scan from your AI client config

# Claude Desktop (macOS)
mcpscan scan --config ~/Library/Application\ Support/Claude/claude_desktop_config.json

# Auto-discover all known config locations (Claude, Cursor, etc.)
mcpscan scan --all-configs

Scan a remote HTTP / SSE server

mcpscan scan --target http://localhost:3000/mcp

Sweep localhost for exposed MCP servers

mcpscan scan --all-configs --network

Run targeted checks only

mcpscan scan --all-configs --checks tool-poisoning,credential-leak,rce-vectors

Severity filtering

# Only report high and critical
mcpscan scan --all-configs --severity high

CI/CD integration

# Exit code 2 = critical findings, exit code 1 = high findings
mcpscan scan --all-configs --severity high --output sarif > findings.sarif

Discover without scanning

mcpscan discover --all-configs --network
mcpscan discover --all-configs --output json

⚙️ All Options

mcpscan scan [options]

  -c, --config <path>    Path to claude_desktop_config.json or .mcp.json
  -t, --target <url>     Direct HTTP/SSE MCP server URL
  --command <cmd>        Spawn and scan a stdio server
  --args <args>          Space-separated args for --command
  --all-configs          Auto-discover all known MCP config locations
  --network              Also probe localhost ports for exposed HTTP servers
  --checks <list>        Comma-separated checks to run (default: all)
  -o, --output <format>  terminal | json | sarif  (default: terminal)
  --severity <level>     critical | high | medium | low | info  (default: info)
  --timeout <ms>         Per-server connection timeout  (default: 30000)
  --verbose              Show check errors and debug output

Config locations searched by --all-configs:

📊 Output Formats

Terminal (default)

Severity-colored findings with CVE references and a summary box. Built for humans.

JSON

Machine-readable report for SIEMs, custom dashboards, and automation:

{
  "tool": "mcpscan",
  "version": "0.1.0",
  "timestamp": "2026-03-10T12:00:00.000Z",
  "summary": {
    "serversScanned": 3,
    "totalFindings": 8,
    "findingsBySeverity": { "critical": 2, "high": 4, "medium": 1, "low": 1, "info": 0 }
  },
  "results": [...]
}

SARIF 2.1.0

Drop directly into GitHub Code Scanning, VS Code SARIF Viewer, or any SARIF-aware security platform. Each finding maps to a rule with security-severity CVSS scores.

🏗️ Architecture

src/
├── cli.ts                    Entry point — commander argument parsing
├── scanner.ts                Orchestrator: enumerate → checks → deduplicate → report
├── types.ts                  Shared interfaces (Finding, ScanResult, CheckFn …)
├── discovery/
│   ├── config-reader.ts      Parses all known MCP config formats (Zod-validated)
│   └── network-scan.ts       Probes localhost ports for exposed HTTP servers
├── transport/
│   ├── stdio-client.ts       StdioClientTransport + timeout + process cleanup
│   └── http-client.ts        StreamableHTTP with SSE fallback; captures response headers
├── checks/
│   ├── tool-poisoning.ts     MCP-1xx — Unicode, injection, base64, exfil
│   ├── credential-leak.ts    MCP-2xx — 16 credential patterns with FP suppression
│   ├── overprivileged.ts     MCP-3xx — Dangerous capability combinations
│   ├── auth-missing.ts       MCP-4xx — Unauthenticated access, CORS, 0.0.0.0
│   ├── session-hijack.ts     MCP-5xx — Session ID exposure and predictability
│   ├── ssrf.ts               MCP-6xx — User-controlled URL parameters
│   ├── rce-vectors.ts        MCP-7xx — Shell execution patterns
│   └── supply-chain.ts       MCP-8xx — CVE ranges, lockfiles, typosquats
└── report/
    ├── terminal.ts           Chalk + Boxen rich terminal output
    └── json.ts               JSON and SARIF 2.1.0 serialization

Each check exports async function check(data: ServerData): Promise<Finding[]>. All checks run in parallel via Promise.allSettled — a broken check never blocks the rest.

🛡️ Finding Schema

interface Finding {
  id: string;           // "MCP-701"
  title: string;        // "RCE Vector: Shell/Execution Parameter Name"
  severity: "critical" | "high" | "medium" | "low" | "info";
  category: string;     // "rce-vectors"
  description: string;  // Full explanation of the risk
  evidence: string;     // The exact value that triggered the finding
  location: string;     // "tool: bash_exec > inputSchema.properties.command"
  cve?: string;         // "CVE-2025-6514"
  cvss?: number;        // 9.6
  remediation: string;  // Actionable fix guidance
}

🔧 Development

# Type-check without building
npm run typecheck

# Run directly without building (uses tsx)
npm run dev -- scan --all-configs

# Full rebuild
npm run build

📚 References

• MCP Specification (2025-11-25)
• OWASP MCP Top 10 (2025)
• Tool Poisoning Attacks — Invariant Labs
• MCP Attack Vectors — Palo Alto Unit 42
• CVE-2025-6514 Deep Dive — JFrog
• MCP Security Best Practices
• Network-Exposed MCP Servers — Trend Micro

Released under the MIT License · Built for the security community