MCPAmpel
Allows scanning of GitHub repositories to identify security vulnerabilities and calculate trust scores for MCP servers.
Allows scanning of GitLab repositories to identify security vulnerabilities and calculate trust scores for MCP servers.
Allows scanning of npm packages to identify security vulnerabilities and calculate trust scores for MCP servers.
Allows scanning of PyPI packages to identify security vulnerabilities and calculate trust scores for MCP servers.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MCPAmpelscan my installed MCP servers for security risks"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCPAmpel - MCP Security Scanner
Scan your installed MCP servers for security vulnerabilities, directly from your AI agent.
MCPAmpel discovers MCP servers from your Claude Code, Cursor, Windsurf, or Gemini CLI configuration, submits them to 16 scanning engines, and returns an aggregated trust score with detailed findings.
50 API calls/day included.
Quick Start
uvx mcpampelRelated MCP server: AgentAudit
Configuration
Claude Code / Claude Desktop
Add to ~/.claude/settings.json or claude_desktop_config.json:
{
"mcpServers": {
"mcpampel": {
"command": "uvx",
"args": ["mcpampel"],
"env": {
"MCPAMPEL_API_KEY": "your_key_here"
}
}
}
}Cursor
Add to ~/.cursor/mcp.json:
{
"mcpServers": {
"mcpampel": {
"command": "uvx",
"args": ["mcpampel"],
"env": {
"MCPAMPEL_API_KEY": "your_key_here"
}
}
}
}Windsurf
Add to ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"mcpampel": {
"command": "uvx",
"args": ["mcpampel"],
"env": {
"MCPAMPEL_API_KEY": "your_key_here"
}
}
}
}Gemini CLI
Add to ~/.gemini/settings.json:
{
"mcpServers": {
"mcpampel": {
"command": "uvx",
"args": ["mcpampel"],
"env": {
"MCPAMPEL_API_KEY": "your_key_here"
}
}
}
}Getting an API Key
Register for free at mcpampel.com.
Environment Variables
Variable | Required | Default | Description |
| Yes | - | Your API key (free at mcpampel.com) |
| No |
| API base URL |
Tools
scan_my_servers
Discovers all MCP servers from your editor config and scans them with 16 engines. Returns a summary table with trust scores. No input needed.
scan_url
Scan a single GitHub, GitLab, npm, or PyPI URL. Returns trust score, engine breakdown, and findings.
Parameter | Type | Required |
| string | Yes |
check_status
Show your daily quota usage and remaining scans.
get_scan_results
Get detailed results for a specific scan by ID. Use after scan_my_servers or scan_url to drill into findings.
Parameter | Type | Required |
| string | Yes |
Development
cd mcp-plugin
uv sync
uv run pytestLicense
Apache License 2.0
Available Tools
4 toolscheck_statusA
Show your daily quota usage and remaining scans.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Mentions 'daily quota' and 'remaining scans' revealing rate-limiting domain model, but omits whether this consumes quota itself, output format/structure, or read-only safety guarantees.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, seven words. Information-dense with zero redundancy. Front-loaded with action verb and specific resource targets.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a zero-parameter status tool. Describes what information is returned (quota and remaining scans) despite lack of output schema. Could improve by indicating return structure or that results are real-time.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters present per schema. With no parameters to document, baseline score applies. Description appropriately focuses on behavior rather than inventing parameter semantics where none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb 'Show' paired with clear resources 'daily quota usage and remaining scans'. Distinctly differs from siblings (scan_url, scan_my_servers, get_scan_results) by focusing on account limits rather than performing or retrieving scans.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage context (checking limits before scanning) through content but lacks explicit when-to-use guidance or warnings. Does not state 'use this before scan_my_servers to verify remaining quota' or clarify that it performs no scanning itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_scan_resultsB
Get full detailed results for a specific scan by its ID.
| Name | Required | Description | Default |
|---|---|---|---|
| scan_id | Yes | UUID of the scan |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds context that results are 'full detailed' (suggesting comprehensive data retrieval), but fails to disclose whether this is a read-only operation, if there are rate limits, or what happens if the scan is incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient 10-word sentence that front-loads the action ('Get') and immediately qualifies the scope. There is no redundant or wasted language.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple single-parameter schema and lack of output schema, the description is minimally adequate. However, it could improve by clarifying that this retrieves results from previously initiated scans (complementing the sibling scan tools) or hinting at the output structure since no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage ('UUID of the scan'), establishing a baseline of 3. The description mentions 'by its ID' which aligns with the scan_id parameter, but adds no additional semantics regarding ID format, validation rules, or where to obtain the ID from sibling tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'full detailed results for a specific scan', distinguishing it from sibling tools like 'scan_my_servers' or 'scan_url' which likely initiate scans. However, it does not explicitly differentiate from 'check_status' (which might return metadata vs. full results) or explicitly state this is for retrieving completed scan data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its siblings. It does not mention that this should be used after initiating a scan with 'scan_my_servers' or 'scan_url', nor when to prefer 'check_status' instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_my_serversA
Discover all MCP servers installed in your editor/agent config (Claude Code, Cursor, Windsurf, Gemini CLI) and scan them for security issues with 16 engines. Returns trust scores.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses scan intensity ('16 engines') and output type ('trust scores'), but omits critical behavioral traits: safety profile (read-only vs. destructive), execution duration expectations, side effects (does it modify configs?), or authentication requirements. Adequate but has clear gaps for a security scanning operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero waste. First sentence covers the full operation (discovery + scanning with 16 engines), second covers return values. Front-loaded with the most important information (what it does and where it looks). Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and no output schema, the description adequately compensates by mentioning the return value ('trust scores'). For a scanning tool, it covers the essential invocation context. Could be improved by describing the output structure or format since no output schema exists, but sufficient for correct tool selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has zero parameters. As per scoring rules, zero-parameter tools receive a baseline score of 4. The description appropriately requires no parameter explanation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verbs ('Discover', 'scan') and clearly identifies the resource ('MCP servers installed in your editor/agent config'). Lists specific editors (Claude Code, Cursor, Windsurf, Gemini CLI) to scope the operation. Explicitly states the return value ('trust scores'), clearly distinguishing it from sibling 'scan_url' (which targets URLs) and 'get_scan_results' (which retrieves existing results).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear contextual boundaries ('installed in your editor/agent config') that implicitly define when to use this versus 'scan_url'. However, lacks explicit 'when-not' guidance or named alternatives (e.g., doesn't state 'use scan_url for remote servers instead'). The specific editor list strongly implies the local/config use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_urlA
Scan a single URL (GitHub, GitLab, npm, or PyPI) for security issues with 16 engines.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL to scan (GitHub, GitLab, npm, or PyPI) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds valuable context by specifying '16 engines,' indicating the scanning depth. However, it omits critical operational details: whether the scan is synchronous or asynchronous, authentication requirements, rate limits, or what data is retained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence with zero waste. Every clause earns its place: the verb defines the action, 'single URL' scopes the operation, the parenthetical lists valid inputs, 'security issues' defines the target, and '16 engines' specifies methodology.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema and the existence of sibling 'get_scan_results,' the description should ideally indicate what this tool returns (e.g., a scan ID vs. full results). While adequate for basic invocation, it leaves ambiguity about the async workflow pattern suggested by the sibling tool names.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage, establishing a baseline of 3. The main description essentially mirrors the schema's enumeration of supported platforms (GitHub, GitLab, npm, PyPI) without adding syntax details, validation rules, or examples beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description provides a specific verb ('Scan'), resource ('URL'), and scope ('security issues with 16 engines'). It distinguishes from sibling 'scan_my_servers' via the explicit 'single URL' qualifier and lists supported platforms (GitHub, GitLab, npm, PyPI), though it could explicitly clarify that this initiates the scan versus 'get_scan_results'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage constraints by listing the four supported platform types (GitHub, GitLab, npm, PyPI), guiding users toward valid inputs. However, it lacks explicit workflow guidance regarding the relationship to 'get_scan_results' (e.g., whether this returns immediately with a scan ID or blocks for results) and doesn't specify when to prefer this over 'scan_my_servers'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool has a clearly distinct purpose: quota checking, local server scanning, URL scanning, and result retrieval. No functional overlap exists between the four tools.
Tools follow a consistent snake_case pattern with leading action verbs (check, get, scan). Minor deviation with 'scan_my_servers' including the possessive pronoun 'my' while others use direct nouns (scan_url, get_scan_results).
Four tools is an appropriate, focused count for a security scanning service covering status checks, two distinct scan targets (local servers vs remote URLs), and result retrieval.
Core scanning workflows are present, but the absence of a list_scans tool creates a notable gap—agents cannot discover historical scan IDs without perfect memory of previous scan operations, limiting the utility of get_scan_results.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Security, SEO and AI-visibility scanner for web apps · free scans and focused checks via MCP.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceMCP security scanner for AI agents - detects prompt injection, secrets, PII, and vets MCP servers before installationApache 2.0
- AlicenseAqualityFmaintenanceSecurity scanner for AI agent packages that enables AI agents to audit MCP servers and packages for vulnerabilities, prompt injection, and supply chain attacks.5293AGPL 3.0

AgentAuditofficial
AlicenseAqualityDmaintenanceEnables AI agents to scan MCP servers and AI packages for vulnerabilities, prompt injection, and supply chain attacks.729AGPL 3.0- AlicenseNot gradedqualityBmaintenanceSecurity scanning for AI agent skills, MCP servers, and agent prompts, returning signed trust scores and detailed findings.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/MCPAmpel/mcpampel'
If you have feedback or need assistance with the MCP directory API, please join our Discord server