mcp-security-scanner
Related Servers
Alternatives to mcp-security-scanner
No user-submitted related servers found.
Related Servers
- AlicenseNot gradedqualityBmaintenanceZero-execution static AST security scanner and vulnerability auditor for MCP servers. Detects Command Injection (CWE-78), Path Traversal (CWE-22), Hardcoded Secrets (CWE-798), and Unauthenticated Transports (CWE-306).MIT
- AlicenseNot gradedqualityAmaintenanceScans MCP servers for prompt injection, supply chain attacks, excessive permissions, and code execution risks. Includes an offline blacklist that catches known-compromised packages like LiteLLM 1.82.7/1.82.8 and Trivy with zero latency.19MIT
- FlicenseNot gradedqualityBmaintenanceEnables static security scanning of MCP servers, AI agent skills, and plugins by detecting attack patterns across severity levels and producing SARIF output for GitHub Code Scanning.-
- AlicenseNot gradedqualityDmaintenanceScans MCP servers for security vulnerabilities, prompt injection, and tool poisoning, providing risk scores and protection.4MIT
- AlicenseNot gradedqualityCmaintenanceAudits MCP server configurations and packages for security risks such as typosquats, credential exposure, and malicious code, with zero dependencies and no execution.2MIT
- FlicenseNot gradedqualityBmaintenanceThe security runtime for MCP servers. Every tool call inspected. Every attack blocked. Every decision logged.1-
TDQS
Scored across 55 tools
Tools are clearly organized by category prefixes (cfg_, dep_, report_, rt_, sast_, scanner_) with distinct, specific names within each group. Potential overlaps like rt_check_tool_poisoning and rt_check_prompt_injection are differentiated by target (tool descriptions vs. prompt content).
All tools follow a consistent prefix_category_descriptiveName pattern in snake_case (e.g., cfg_audit_mcp_config, sast_command_injection). The scanner_ tools deviate slightly (scanner_list_checks, scanner_owasp_mapping) but remain consistent within their subgroup.
55 tools is high but justified for a comprehensive security scanner covering config, dependencies, runtime, static analysis, and reporting. While some tools could potentially be merged, each addresses a specific security concern, and the count reflects the domain's breadth.
The tool set covers all major security audit areas: configuration auditing, dependency analysis, static code analysis, runtime checks, reporting, and OWASP mapping. No obvious gaps; even includes meta-tools for listing checks and comparing reports.