Project Shield

Security scanner for MCP servers and AI-generated code.

One command to security-grade your MCP server.

Installation

npm install -g project-shield

Or use directly with npx:

npx project-shield scan .

Add to your MCP client config:

{
  "mcpServers": {
    "project-shield": {
      "command": "npx",
      "args": ["-y", "project-shield", "scan", "."]
    }
  }
}

Security scan a directory or MCP server project. Returns A-F grade with detailed findings.

Parameters:

Get the security grade for a project without full report.

Generate a tamper-proof Evidence Pack with SHA-256 hashed scan results.

Layer	What	How
Secrets	API keys, tokens, credentials	Regex + entropy + context analysis
PII	Email, phone, SSN	Pattern matching + checksum validation
Prompt Injection	Attacks in MCP tool descriptions	Heuristic + pattern detection
MCP Misconfig	Missing auth, open permissions, no logging	Config rule engine

Grade	Meaning
A	Excellent - ship with confidence
B	Good - minor improvements suggested
C	Clean - some issues to address
D	Warning - fix before deploy
E	Warning - significant issues found
F	Locked - deployment blocked until fixed