Skip to content
Agentmart
Submit a tool

Agent Security Scanner MCP

Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.

Connector by sinewaveai · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 124
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/sinewaveai-agent-security-scanner-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.

Use cases: security-scanning, code-review

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
22 read · 0 write · 0 delete · 2 not yet classified
Secrets
None asked for
Install scripts
Not scanned yet
Runs as
Node.js package

Tools by what they do 24

Read from the source code; the running server may list different tools.

Read 22 · Look things up without changing anything.

  • check_package
  • clawproof_health
  • deep_audit
  • evaluate_compliance
  • fix_security
  • get_compliance_controls
  • inspect_mcp_server
  • list_package_stats
  • list_security_rules
  • sbom_check_hallucinations
  • sbom_diff
  • sbom_scan_vulnerabilities
Show 10 more tools
  • scan_agent_action
  • scan_agent_prompt
  • scan_git_diff
  • scan_mcp_server
  • scan_packages
  • scan_project
  • scan_security
  • scan_skill
  • scanner_health
  • score_aivss

Not yet classified 2 · We could not tell from the name and description.

  • sbom_export_report
  • sbom_generate

Files it touches

  • Any path the agent passes to its tools

Tools (24)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • check_package

    Check if a package name is legitimate or potentially hallucinated (AI-invented)

  • clawproof_health

    Alias for scanner_health (deprecated, use scanner_health instead)

  • deep_audit

    Optional LLM-powered deep security audit. Sends code to an AI model for analysis beyond what regex rules can detect. Requires API key and explicit consent (PROOFLAYER_LLM_CONSENT=1).

  • evaluate_compliance

    Evaluate a project against compliance frameworks (SOC2-technical, GDPR-technical, AIUC-1). Collects evidence from code scans, SBOM, vulnerability checks, and hallucination detection, then evaluates controls. Optionally saves timestamped evidence bundle.

  • fix_security

    Scan a file and return fixes. Use verbosity='minimal' for summary only, 'compact' (default) for fix list, 'full' for complete fixed file content.

  • get_compliance_controls

    Look up compliance controls with evaluation criteria. Supports multiple frameworks: aiuc-1 (default), soc2-technical, gdpr-technical. Filter by domain, control IDs, or OWASP LLM tags.

  • inspect_mcp_server

    Launch a live MCP server process, connect via stdio, call tools/list, and scan returned tool definitions for poisoning (description injection, name spoofing, unicode attacks, schema manipulation). Read-only probe — never calls any tools.

  • list_package_stats

    List statistics about loaded package lists for hallucination detection

  • list_security_rules

    List all available security fix templates and their descriptions

  • sbom_check_hallucinations

    Check all packages in an SBOM against official registries to detect hallucinated (AI-invented) package names. Supports npm, pypi, rubygems, dart, perl, raku, crates. Go/Java marked as unsupported.

  • sbom_diff

    Compare current project SBOM against a stored baseline. Reports added, removed, and version-changed packages. Use save_baseline=true to create initial baseline.

  • sbom_export_report

    Generate an HTML or JSON audit report from SBOM data, optionally enriched with vulnerability scan results. Suitable for PCI-DSS and compliance audits.

  • sbom_generate

    Generate a CycloneDX v1.5 SBOM for a project. Discovers all dependencies (direct + transitive) from lock files and manifests across Node.js, Python, Go, Rust, Ruby, Java. Use verbosity='minimal' for counts, 'compact' (default) for component list, 'full' for complete CycloneDX JSON.

  • sbom_scan_vulnerabilities

    Cross-reference SBOM components against OSV.dev vulnerability database. Returns CVE IDs, CVSS scores, severity, and fix recommendations. Accepts directory_path (generates fresh) or sbom_path (loads saved artifact).

  • scan_agent_action

    Pre-execution security check for agent actions (bash, file_write, file_read, http_request, file_delete, cron, process_spawn, git, docker). Returns ALLOW/WARN/BLOCK.

Show 9 more tools
  • scan_agent_prompt

    Scan a prompt for malicious intent. Returns BLOCK/WARN/LOG/ALLOW. Use verbosity='minimal' for action only, 'compact' (default) for findings, 'full' for audit details.

  • scan_git_diff

    Scan git diff for new security vulnerabilities. Only reports issues on changed lines. Use for PR reviews.

  • scan_mcp_server

    Scan an MCP server's source code for security vulnerabilities: overly broad permissions, missing input validation, data exfiltration, insecure patterns. Returns grade (A-F) and recommendations.

  • scan_packages

    Scan code for package imports and check for hallucinated (AI-invented) packages. Use verbosity='minimal' for counts, 'compact' (default) for flagged packages, 'full' for all details.

  • scan_project

    Scan an entire directory for security vulnerabilities with .gitignore support and security grading. Use verbosity='minimal' for grade + counts, 'compact' (default) for top issues, 'full' for all details.

  • scan_security

    Scan a file for security vulnerabilities. Use verbosity='minimal' for counts only (~50 tokens), 'compact' (default) for actionable info (~200 tokens), 'full' for complete metadata.

  • scan_skill

    Deep security scan of an OpenClaw skill. Multi-layer analysis: prompt injection detection, code analysis (AST+taint), ClawHavoc malware signatures, package supply chain verification, rug pull detection. Returns security grade A-F with detailed findings.

  • scanner_health

    Check plugin health: engine status, daemon status, package data availability

  • score_aivss

    Score findings using OWASP AIVSS v2. Accepts any scanner output or raw findings JSON. Returns per-finding AIVSS scores (0-10) and aggregate posture. Use verbosity='minimal' for posture only, 'compact' (default) for scores, 'full' for all metrics.

Compare and alternatives

    Featured in

    Signals

    Stars
    124
    Forks
    12
    Open issues
    2
    Contributors
    8
    Last commit
    Sep 2, 2026 (1 month ago)
    Last release
    Jun 22, 2026 (4 months ago)

    From GitHub (fetched Oct 24, 2026).

    Details

    Registry name
    io.github.sinewaveai/agent-security-scanner-mcp
    Version
    2.0.1
    Auth
    No auth
    Packages
    npm agent-security-scanner-mcp
    License
    MIT
    Repository
    github.com/sinewaveai/agent-security-scanner-mcp
    First seen
    Oct 24, 2026
    Last checked
    Oct 24, 2026
    Source
    Official MCP Registrygithub-graphql
    Cite this page

    Agent Security Scanner MCP. Agent Mart. https://agentmart.dev/connectors/sinewaveai-agent-security-scanner-mcp (last updated 2026-10-24)