Security scanning for MCP servers from the inside out. Provides runtime inspection, AST-based static analysis, config audit, dependency analysis, and OWASP MCP Top 10 compliance in a single MCP server.
Enables static security scanning of MCP servers, AI agent skills, and plugins by detecting attack patterns across severity levels and producing SARIF output for GitHub Code Scanning.
Security scanner for MCP servers that detects tool poisoning, shadowing, and other risks via static rules and semantic analysis. Exposes the scan_mcp_server tool for scanning MCP servers over stdio.
Security auditor for MCP servers that enumerates tools, resources, and prompts, scans for injection patterns, classifies risk levels, and produces a scored report (0-100, grades A-F).
Audits MCP server configurations and packages for security risks such as typosquats, credential exposure, and malicious code, with zero dependencies and no execution.