Analice cualquier servidor MCP en busca de la clase de inyección de prompts / envenenamiento de herramientas / SSRF revelada en la oleada de CVE de abril de 2026.
pip install meok-mcp-injection-scan-mcpAbril de 2026 fue un mal mes para MCP. Anthropic publicó una clase de RCE en MCP "por diseño" que afectó a unos 7.000 servidores públicos (~150 millones de descargas). mcp-server-git lanzó una cadena de CVE. DockerDash fue comprometido por una cadena de inyección. La inyección de prompts en la descripción de herramientas ("envenenamiento de herramientas") se demostró contra todos los principales hosts de MCP.
Si ejecuta un servidor MCP en producción, o está auditando uno antes de adoptarlo, necesita un análisis rápido que marque los patrones a los que apuntan las revelaciones de abril de 2026. Este MCP es ese análisis.
Related MCP server: agent-audit
Más de 30 reglas canónicas en 5 niveles de gravedad:
CRÍTICO — RCE directo, anulación del prompt del sistema, patrones de exfiltración de credenciales, metacaracteres de shell en valores predeterminados, URLs file:// / red interna (el vector de pivote de metadatos 169.254.169.254 de DockerDash).
ALTO — cargas útiles codificadas, directivas imperativas en el agente, prompts de cadena de suministro, referencias a variables de entorno, suplantación de herramientas.
MEDIO — lenguaje de urgencia / autoridad, additionalProperties=true, cadenas sin límites, suplantación de nombre de herramienta.
BAJO — descripciones demasiado largas, caracteres de ancho cero / anulación bidireccional (el vector PoC U+202E).
La cobertura se asigna a: OWASP LLM Top 10, GenAI Red Team v1, la revelación de RCE en MCP de Anthropic de abril de 2026 y la cadena de CVE de mcp-server-git.
Herramienta | Propósito |
| Obtener el listado de herramientas de un servidor MCP remoto y analizarlo |
| Analizar una lista de herramientas JSON pegada (servidores con autenticación) |
| Emitir un certificado firmado de nivel de adquisición (nivel Pro) |
| Inspeccionar el catálogo completo de reglas antes de suscribirse |
| Enlaces de suscripción + comparación de niveles |
Nivel | Precio | Qué obtiene |
Gratuito | £0 | 5 análisis / día, sin informes firmados |
Starter | Análisis ilimitados + informes firmados | |
Pro | + reanálisis programados + soporte 48h | |
Enterprise | + paquetes de reglas personalizados + SLA de 4h |
Cada certificado firmado reside en https://meok-attestation-api.vercel.app/verify/<cert_id> — los auditores y los equipos de adquisiciones pueden verificarlo sin necesidad de una cuenta.
Este es un escáner de patrones estáticos. No ejecuta análisis dinámico de contaminación, no realiza fuzzing al servidor con entradas adversarias ni reemplaza a un equipo de red-team humano. Es el primer 80% de la auditoría, en 5 segundos, de forma gratuita.
Fundador único. Londres. 234 paquetes MCP en PyPI. Infraestructura de firma en vivo en meok-attestation-api.vercel.app. Escaparate councilof.ai. Obtenga el catálogo: https://meok-attestation-api.vercel.app/catalogue.
PyPI: pip install meok-mcp-injection-scan-mcp (este paquete)
Apify Store (Pago por evento): https://apify.com/knowing_yucca/meok-mcp-injection-scan
GitHub (fuente): https://github.com/CSOAI-ORG/MEOK-LABS/tree/main/mcps/meok-mcp-injection-scan-mcp
Patrocinador: https://github.com/sponsors/CSOAI-ORG · Pro £79/mes →
Audit a JSON string containing a tool list (paste from your own MCP server's tools/list output). Same rule catalogue as scan_mcp_url — useful when the server is behind auth or not yet deployed.
tools_json accepts either: a raw list, or {"tools": [...]}, or
{"result": {"tools": [...]}}.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation.
When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.
Args: tools_json (str): The tools json to analyze or process. api_key (str): The api key to analyze or process.
| Name | Required | Description | Default |
|---|---|---|---|
| tools_json | Yes | ||
| api_key | No |
List every detection rule in the canonical catalogue. Useful for buyers auditing what we check before subscribing.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation.
When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Pricing + subscribe links for this MCP.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation.
When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Fetch a remote MCP server's /tools/list (or any JSON tool listing) and scan every tool's name + description + inputSchema against the canonical 30+ injection-pattern rules.
Returns a structured report: per-tool findings, severity counts, score 0-100, verdict, and remediation hints. Free tier: 5 scans/day per key.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation.
When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.
Args: url (str): The url to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| api_key | No |
Issue a cryptographically signed safety report for the scanned MCP server. Returns a cert with a public verify URL anyone can hit to confirm the audit happened on the date claimed.
Pro / Enterprise tier only.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation.
When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.
Args: subject (str): The subject to analyze or process. findings_json (str): The findings json to analyze or process. score (int): The score to analyze or process. note (str): The note to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
| subject | Yes | ||
| findings_json | No | ||
| score | No | ||
| note | No | ||
| api_key | No |
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.1audit_tool_descriptionslist_rulespricingscan_mcp_urlsigned_safety_reportScored across 5 tools
Each tool targets a distinct aspect of the security scanning workflow: 'audit_tool_descriptions' handles local JSON analysis, 'scan_mcp_url' handles remote scanning, 'list_rules' lists detection rules, 'pricing' provides subscription details, and 'signed_safety_report' generates a signed certificate. No two tools have overlapping purposes.
The naming convention is mostly snake_case but inconsistent in structure: three tools follow a verb_noun pattern ('audit_tool_descriptions', 'list_rules', 'scan_mcp_url'), while 'pricing' is a bare noun and 'signed_safety_report' uses a past participle adjective-noun form. This mix reduces predictability.
With 5 tools, the server is well-scoped for its purpose of scanning MCP servers for injection vulnerabilities. Each tool serves a clear function without overlap, and the count is appropriate for a focused security assessment tool.
The tool surface covers the core workflow: local audit, remote scan, rule listing, pricing, and signed reporting. Minor gaps exist (e.g., no tool for configuration or result history), but these are not essential for the primary use case. Overall, the surface is sufficiently complete for its domain.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security scanner for AI agents and MCP servers: injection, jailbreak, tool abuse.
Audit your MCP servers for poisoned tools and leaked secrets, and check AI-generated code for flaws.
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.