mcp-security-scanner
Related Servers
Alternatives to mcp-security-scanner
No user-submitted related servers found.
Related Servers
- AlicenseNot gradedqualityBmaintenanceZero-execution static AST security scanner and vulnerability auditor for MCP servers. Detects Command Injection (CWE-78), Path Traversal (CWE-22), Hardcoded Secrets (CWE-798), and Unauthenticated Transports (CWE-306).MIT
- AlicenseNot gradedqualityAmaintenanceScans MCP servers for prompt injection, supply chain attacks, excessive permissions, and code execution risks. Includes an offline blacklist that catches known-compromised packages like LiteLLM 1.82.7/1.82.8 and Trivy with zero latency.19MIT
- AlicenseAqualityAmaintenanceSecurity for the MCP servers you use: detects tool poisoning, rug pulls, shadowing, secrets and supply-chain risk (OWASP MCP Top 10), with runtime guards and approved-server policy. Runs locally.1770 npmMIT
- FlicenseNot gradedqualityBmaintenanceEnables static security scanning of MCP servers, AI agent skills, and plugins by detecting attack patterns across severity levels and producing SARIF output for GitHub Code Scanning.-
- AlicenseNot gradedqualityDmaintenanceScans MCP servers for security vulnerabilities, prompt injection, and tool poisoning, providing risk scores and protection.4MIT
- AlicenseNot gradedqualityCmaintenanceAudits MCP server configurations and packages for security risks such as typosquats, credential exposure, and malicious code, with zero dependencies and no execution.1MIT
TDQS
Scored across 55 tools
Tools are clearly organized by category prefixes (cfg_, dep_, report_, rt_, sast_, scanner_) with distinct, specific names within each group. Potential overlaps like rt_check_tool_poisoning and rt_check_prompt_injection are differentiated by target (tool descriptions vs. prompt content).
All tools follow a consistent prefix_category_descriptiveName pattern in snake_case (e.g., cfg_audit_mcp_config, sast_command_injection). The scanner_ tools deviate slightly (scanner_list_checks, scanner_owasp_mapping) but remain consistent within their subgroup.
55 tools is high but justified for a comprehensive security scanner covering config, dependencies, runtime, static analysis, and reporting. While some tools could potentially be merged, each addresses a specific security concern, and the count reflects the domain's breadth.
The tool set covers all major security audit areas: configuration auditing, dependency analysis, static code analysis, runtime checks, reporting, and OWASP mapping. No obvious gaps; even includes meta-tools for listing checks and comparing reports.