🛡️ AdaLab Scanner (adalab-scanner)

Continuous Security Fuzzer & Verification Engine for Model Context Protocol (MCP)

Web Platform • MCP Directory • CI/CD Docs

📌 Overview

AdaLab Scanner is a zero-dependency security CLI and Model Context Protocol (MCP) server. Traditional linters miss AI-native failure modes like indirect prompt injections, tool parameter poisoning, and unconstrained subshell execution.

This package allows developers to locally audit codebases and run automated security gates in GitHub Actions.

Related MCP server: meok-mcp-injection-scan-mcp

⚡ Instant CLI Usage (Zero Install)

Run directly against your local MCP server repository:

npx adalab-scanner scan .

What it checks:

1. Tool Boundary Containment: AST analysis for raw child_process.exec, eval(), and unsanitized subshells.

2. Prompt Injection Vectors: Detects unescaped string concatenations into agent system prompts.

3. Secret & Key Bleed: Flags hardcoded API keys (sk-, ghp_, cloud credentials).

4. JSON-RPC Schema Conformance: Validates inputSchema to prevent model parameter hallucinations.

🔌 Run as an MCP Server (Claude Desktop, Cursor, Cline)

AdaLab also runs as a native MCP server over stdio. Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "adalab": {
      "command": "npx",
      "args": ["-y", "adalab-scanner", "mcp"]
    }
  }
}

Available MCP Tools:

• scan_code_security: Audit local files for prompt injection surfaces and shell escapes.

• fuzz_prompt_injection: Test system prompts against common jailbreak and injection payloads.

• get_verification_badge: Generate Shields.io-compatible markdown badges for your repo.

🚀 GitHub Actions CI/CD Gate

Add continuous security checking to your repository:

name: AdaLab Security Gate

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run AdaLab Scanner
        run: npx adalab-scanner scan .

🏷️ Embed Verification Badge in README

Display live verification status on your project:

[![AdaLab Verified](https://adalab.cc/api/badge/OWNER/REPO)](https://adalab.cc/audit/OWNER/REPO)

🔗 Cloud Platform & Enterprise Audit

For private repository analysis, SOC 2 compliance exports, and webhook notifications (Slack/Discord), visit adalab.cc.

License: Apache-2.0