MCP Server Security Scanner

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/vpatser1-mcp-server-security-scanner

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

4 read · 0 write · 0 delete · 1 not yet classified

Secrets

1 (API keys, tokens or passwords)

Install scripts

Not scanned yet

Runs as

Node.js package

Tools (5)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• check_cvesCheck Known CVEs

  Checks a list of MCP server names and optional versions against a database of known CVEs in the MCP ecosystem (covering path traversal, SSRF, auth bypass, prompt injection, data exfiltration, command injection, and SQL injection). Returns matching CVEs with severity, CVSS scores, and remediation steps.

• generate_reportGenerate Security Report

  Generates a comprehensive security report from scan results. Includes an executive summary with overall risk score (0-100), detailed findings with remediation steps, and a SOC 2 compliance checklist. Output is Markdown-formatted.

• scan_configScan MCP Configuration

  Scans an MCP configuration file (claude_desktop_config.json, .mcp.json, etc.) for security vulnerabilities including hardcoded secrets, excessive permissions, insecure transports, missing authentication, and known vulnerable server versions.

• scan_tool_definitionsScan Tool Definitions

  Analyzes MCP tool definitions for security vulnerabilities including prompt injection vectors, tool poisoning patterns, overly broad filesystem access, command injection risks, and data exfiltration patterns.

• validate_authValidate Authentication Configuration

  Validates OAuth 2.1, API key, or bearer token authentication configuration for an MCP server. Checks for proper PKCE usage, token storage security, redirect URI validation, token expiration settings, and overall auth best practices.

Signals

Last release

Aug 4, 2026 (2 months ago)

Details

Registry name

io.github.vpatser1/mcp-server-security-scanner

Version

1.1.4

Auth

API key

Packages

npm mcp-server-security-scanner

License

License unknown

Website

aivp-mcp.vercel.app

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registry