Сканируйте любой MCP-сервер на наличие классов уязвимостей внедрения промптов / отравления инструментов / SSRF, раскрытых в волне CVE в апреле 2026 года.
pip install meok-mcp-injection-scan-mcpАпрель 2026 года стал неудачным месяцем для MCP. Anthropic опубликовала информацию о классе RCE в MCP «по дизайну», который затронул около 7000 публичных серверов (~150 млн загрузок). mcp-server-git выпустил цепочку CVE. DockerDash был взломан через цепочку внедрений. Внедрение промптов в описание инструментов («отравление инструментов») было продемонстрировано против каждого крупного хоста MCP.
Если вы запускаете MCP-сервер в продакшене или проводите аудит перед внедрением, вам нужно быстрое сканирование, которое помечает шаблоны, на которые нацелены раскрытия апреля 2026 года. Этот MCP — и есть такое сканирование.
Related MCP server: agent-audit
Более 30 канонических правил в 5 уровнях критичности:
КРИТИЧЕСКИЙ — прямой RCE, переопределение системного промпта, шаблоны кражи учетных данных, метасимволы оболочки в значениях по умолчанию, URL-адреса file:// / внутренней сети (вектор поворота метаданных DockerDash 169.254.169.254).
ВЫСОКИЙ — закодированные полезные нагрузки, императивные директивы для агента, промпты цепочки поставок, ссылки на переменные окружения, подмена инструментов.
СРЕДНИЙ — язык срочности / авторитетности, additionalProperties=true, неограниченные строки, имитация имени инструмента.
НИЗКИЙ — слишком длинные описания, символы нулевой ширины / двунаправленного переопределения (вектор PoC U+202E).
Покрытие соответствует: OWASP LLM Top 10, GenAI Red Team v1, раскрытию RCE в Anthropic MCP в апреле 2026 года и цепочке CVE mcp-server-git.
Инструмент | Назначение |
| Получить список инструментов удаленного MCP-сервера и просканировать его |
| Просканировать вставленный список инструментов JSON (для серверов с аутентификацией) |
| Выдать подписанный сертификат уровня закупок (тариф Pro) |
| Изучить полный каталог правил перед подпиской |
| Ссылки на подписку + сравнение тарифов |
Тариф | Цена | Что вы получаете |
Free | £0 | 5 сканирований / день, без подписанных отчетов |
Starter | Безлимитные сканирования + подписанные отчеты | |
Pro | + запланированные повторные сканирования + поддержка 48ч | |
Enterprise | + пользовательские наборы правил + SLA 4ч |
Каждый подписанный сертификат находится по адресу https://meok-attestation-api.vercel.app/verify/<cert_id> — аудиторы и отделы закупок могут проверить его без учетной записи.
Это сканер статических шаблонов. Он не выполняет динамический анализ загрязнения, не фаззит сервер состязательными входными данными и не заменяет человеческую «красную команду» (red-team). Это первые 80% аудита, за 5 секунд, бесплатно.
Основатель-одиночка. Лондон. 234 пакета MCP на PyPI. Инфраструктура подписи в реальном времени на meok-attestation-api.vercel.app. Витрина councilof.ai. Получить каталог: https://meok-attestation-api.vercel.app/catalogue.
PyPI: pip install meok-mcp-injection-scan-mcp (этот пакет)
Apify Store (оплата за событие): https://apify.com/knowing_yucca/meok-mcp-injection-scan
GitHub (исходный код): https://github.com/CSOAI-ORG/MEOK-LABS/tree/main/mcps/meok-mcp-injection-scan-mcp
Спонсор: https://github.com/sponsors/CSOAI-ORG · Pro £79/мес →
Audit a JSON string containing a tool list (paste from your own MCP server's tools/list output). Same rule catalogue as scan_mcp_url — useful when the server is behind auth or not yet deployed.
tools_json accepts either: a raw list, or {"tools": [...]}, or
{"result": {"tools": [...]}}.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation.
When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.
Args: tools_json (str): The tools json to analyze or process. api_key (str): The api key to analyze or process.
| Name | Required | Description | Default |
|---|---|---|---|
| tools_json | Yes | ||
| api_key | No |
List every detection rule in the canonical catalogue. Useful for buyers auditing what we check before subscribing.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation.
When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Pricing + subscribe links for this MCP.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation.
When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Fetch a remote MCP server's /tools/list (or any JSON tool listing) and scan every tool's name + description + inputSchema against the canonical 30+ injection-pattern rules.
Returns a structured report: per-tool findings, severity counts, score 0-100, verdict, and remediation hints. Free tier: 5 scans/day per key.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation.
When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.
Args: url (str): The url to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| api_key | No |
Issue a cryptographically signed safety report for the scanned MCP server. Returns a cert with a public verify URL anyone can hit to confirm the audit happened on the date claimed.
Pro / Enterprise tier only.
Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage.
When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation.
When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.
Args: subject (str): The subject to analyze or process. findings_json (str): The findings json to analyze or process. score (int): The score to analyze or process. note (str): The note to analyze or process. api_key (str): The api key to analyze or process.
Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.
| Name | Required | Description | Default |
|---|---|---|---|
| subject | Yes | ||
| findings_json | No | ||
| score | No | ||
| note | No | ||
| api_key | No |
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.1audit_tool_descriptionslist_rulespricingscan_mcp_urlsigned_safety_reportScored across 5 tools
Each tool targets a distinct aspect of the security scanning workflow: 'audit_tool_descriptions' handles local JSON analysis, 'scan_mcp_url' handles remote scanning, 'list_rules' lists detection rules, 'pricing' provides subscription details, and 'signed_safety_report' generates a signed certificate. No two tools have overlapping purposes.
The naming convention is mostly snake_case but inconsistent in structure: three tools follow a verb_noun pattern ('audit_tool_descriptions', 'list_rules', 'scan_mcp_url'), while 'pricing' is a bare noun and 'signed_safety_report' uses a past participle adjective-noun form. This mix reduces predictability.
With 5 tools, the server is well-scoped for its purpose of scanning MCP servers for injection vulnerabilities. Each tool serves a clear function without overlap, and the count is appropriate for a focused security assessment tool.
The tool surface covers the core workflow: local audit, remote scan, rule listing, pricing, and signed reporting. Minor gaps exist (e.g., no tool for configuration or result history), but these are not essential for the primary use case. Overall, the surface is sufficiently complete for its domain.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security scanner for AI agents and MCP servers: injection, jailbreak, tool abuse.
Audit your MCP servers for poisoned tools and leaked secrets, and check AI-generated code for flaws.
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.